Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-04-2024 01:22

General

  • Target

    eff86670294eff00ad9939f819212fe1_JaffaCakes118.exe

  • Size

    954KB

  • MD5

    eff86670294eff00ad9939f819212fe1

  • SHA1

    d19b908bd145091ad5daacb527f226c6fbd61be0

  • SHA256

    011995e4a15b31e09854361d1c1f1024f5c0c2e965ba2892cf0080c586cbf4e7

  • SHA512

    f1f81fe38147d390eeaf32b6dfba6b042a935fe4e814694fd0a64ec178248a3d803d0a2b0e64560995c3b6583e0ba062f53bab9b6272200c31d61a60996eedb9

  • SSDEEP

    12288:2OArYqQXh4GCSVtwvPhC4wq/qkLdTu3rLS7Q3CkMQbk9s7N1eb6GziPEwkJU56v9:fAmZTwRwoQnQnkJkNFmP0RvbWKvt

Malware Config

Extracted

Family

ffdroider

C2

http://186.2.171.3

Signatures

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

  • FFDroider payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eff86670294eff00ad9939f819212fe1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eff86670294eff00ad9939f819212fe1_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2584-1-0x0000000000400000-0x000000000063C000-memory.dmp

    Filesize

    2.2MB

  • memory/2584-2-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2584-20-0x0000000000400000-0x000000000063C000-memory.dmp

    Filesize

    2.2MB

  • memory/2584-23-0x0000000002F70000-0x0000000002F80000-memory.dmp

    Filesize

    64KB

  • memory/2584-29-0x0000000003690000-0x00000000036A0000-memory.dmp

    Filesize

    64KB

  • memory/2584-39-0x0000000000400000-0x000000000063C000-memory.dmp

    Filesize

    2.2MB