Analysis
- max time kernel
134s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
26/07/2024, 18:38
General
- Target 753f316cffd68bd3c5161c8387a770b4_JaffaCakes118.exe
- Size 694KB
- Sample240726-w99ebaxbml
- SHA256 1ef805d037a3e6d5667c5f09316d85231d217c452c0759fd16ccd34f75e3c22c
Malware Config
Extracted
-
oski
-
hanxlas.ac.ug
Signatures
- Oski
Oski is an infostealer targeting browser data, crypto wallets.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\753f316cffd68bd3c5161c8387a770b4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\753f316cffd68bd3c5161c8387a770b4_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\753f316cffd68bd3c5161c8387a770b4_JaffaCakes118.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\753f316cffd68bd3c5161c8387a770b4_JaffaCakes118.exe"{path}"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 13043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1792 -ip 17921⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1792-11-0x0000000000400000-0x0000000000434000-memory.dmp
memory/1792-19-0x0000000000400000-0x0000000000434000-memory.dmp
memory/1792-15-0x0000000000400000-0x0000000000434000-memory.dmp
memory/1792-14-0x0000000000400000-0x0000000000434000-memory.dmp
memory/1792-12-0x0000000000400000-0x0000000000434000-memory.dmp
memory/3156-4-0x0000000004B30000-0x0000000004B3A000-memory.dmp
memory/3156-6-0x00000000079A0000-0x0000000007A3C000-memory.dmp
memory/3156-7-0x0000000007900000-0x0000000007908000-memory.dmp
memory/3156-8-0x00000000750AE000-0x00000000750AF000-memory.dmp
memory/3156-9-0x00000000750A0000-0x0000000075850000-memory.dmp
memory/3156-10-0x0000000007A40000-0x0000000007AD2000-memory.dmp
memory/3156-5-0x00000000750A0000-0x0000000075850000-memory.dmp
memory/3156-0-0x00000000750AE000-0x00000000750AF000-memory.dmp
memory/3156-3-0x0000000004B50000-0x0000000004BE2000-memory.dmp
memory/3156-2-0x0000000005060000-0x0000000005604000-memory.dmp
memory/3156-16-0x00000000750A0000-0x0000000075850000-memory.dmp
memory/3156-1-0x00000000001F0000-0x00000000002A4000-memory.dmp