Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
11/04/2024, 07:00
General
- Target ecd7365422db60cf4f55f3c6f4ed49bf_JaffaCakes118.exe
- Size 973KB
- Sample240411-hstewaeb95
- SHA256 77041a33e4f52b86a78b12d80a21e48ba25e4d4c430090f33ba69a08f12a83a7
Malware Config
Signatures
- FFDroider
Stealer targeting social media platform users first seen in April 2022.
- FFDroider payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecd7365422db60cf4f55f3c6f4ed49bf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ecd7365422db60cf4f55f3c6f4ed49bf_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
d
d.INTEG.RAW
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
memory/540-117-0x0000000004890000-0x0000000004898000-memory.dmp
memory/540-0-0x0000000000400000-0x0000000000661000-memory.dmp
memory/540-130-0x0000000004ED0000-0x0000000004ED8000-memory.dmp
memory/540-131-0x0000000005180000-0x0000000005188000-memory.dmp
memory/540-132-0x0000000005080000-0x0000000005088000-memory.dmp
memory/540-133-0x0000000004EF0000-0x0000000004EF8000-memory.dmp
memory/540-25-0x0000000004A70000-0x0000000004A78000-memory.dmp
memory/540-146-0x00000000048B0000-0x00000000048B8000-memory.dmp
memory/540-154-0x0000000004EF0000-0x0000000004EF8000-memory.dmp
memory/540-156-0x0000000005020000-0x0000000005028000-memory.dmp
memory/540-23-0x00000000049D0000-0x00000000049D8000-memory.dmp
memory/540-22-0x00000000049B0000-0x00000000049B8000-memory.dmp
memory/540-15-0x0000000003F10000-0x0000000003F20000-memory.dmp
memory/540-9-0x0000000003DB0000-0x0000000003DC0000-memory.dmp
memory/540-5-0x0000000000400000-0x0000000000661000-memory.dmp
memory/540-129-0x0000000004950000-0x0000000004958000-memory.dmp
memory/540-126-0x0000000004950000-0x0000000004958000-memory.dmp
memory/540-118-0x00000000048B0000-0x00000000048B8000-memory.dmp
memory/540-45-0x00000000049D0000-0x00000000049D8000-memory.dmp
memory/540-28-0x0000000004BB0000-0x0000000004BB8000-memory.dmp
memory/540-29-0x0000000004BD0000-0x0000000004BD8000-memory.dmp
memory/540-78-0x0000000004BE0000-0x0000000004BE8000-memory.dmp
memory/540-76-0x0000000004D10000-0x0000000004D18000-memory.dmp
memory/540-30-0x0000000004E80000-0x0000000004E88000-memory.dmp
memory/540-68-0x00000000049D0000-0x00000000049D8000-memory.dmp
memory/540-31-0x0000000004D80000-0x0000000004D88000-memory.dmp
memory/540-55-0x0000000004D10000-0x0000000004D18000-memory.dmp
memory/540-53-0x0000000004BE0000-0x0000000004BE8000-memory.dmp
memory/540-1-0x00000000001C0000-0x00000000001C3000-memory.dmp
memory/540-32-0x0000000004BE0000-0x0000000004BE8000-memory.dmp
memory/540-508-0x0000000000400000-0x0000000000661000-memory.dmp