Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 19:48
Static task
static1
Behavioral task
behavioral1
Sample
e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe
-
Size
172KB
-
MD5
e5b890befeb77eae9ca8ef9fe01abed0
-
SHA1
b88ef8ed996df38b72e5ed02572f4a20380ccd7e
-
SHA256
4d7b14fb8a73966555dc561a864a587ef50ff972d698bd27d704545018a92e4c
-
SHA512
d62e9229d8fa3372f3c1cd7597c8d8401f393cc8483fa24cabe571cc253cd399b5172c6589317a29c855a890f9b5dec9bd370ac3a67503d6d24e07f003b46939
-
SSDEEP
3072:RpXw02bG7/Tg2DmffDrbYHHf3xaW3ShYtNYK8eY:oVSTTLmfbHe/haMSNKe
Malware Config
Extracted
pony
http://108.166.65.182:8080/pony/gate.php
http://66.150.188.33/pony/gate.php
-
payload_url
http://bgdt.co.uk/2A3.exe
http://madeiras10.com.br/ZNg8uR.exe
http://aencuentro.com.ar/xc25nXp.exe
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exedescription pid process Token: SeImpersonatePrivilege 1872 e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe Token: SeTcbPrivilege 1872 e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1872 e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe Token: SeCreateTokenPrivilege 1872 e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe Token: SeBackupPrivilege 1872 e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe Token: SeRestorePrivilege 1872 e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 1872 e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 1872 e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exepid process 1872 e5b890befeb77eae9ca8ef9fe01abed0_JaffaCakes118.exe