ffdroider | 3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa

General

Target

9737f768f5539cb2a0853f265e4c32a1_JaffaCakes118.exe
Size

1.1MB
MD5

9737f768f5539cb2a0853f265e4c32a1
SHA1

e91bac502e203094878457a58a70aa0261bc6322
SHA256

3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa
SHA512

6fbcd5ab193fd7a9193238b031e1efef8efae52d6d24f011bd0420baffe6b330c126f5315bc6d20ff50186ec175910db93ef9c41a187e20aa1d4b36b55e6df22
SSDEEP

24576:hbIQ9iBHtWkOLTBDNSl6nNoYOmubsdI5oansjqFJaN0cKKwt:Z9ibiTBDNXTJjqFDc9w

Score

10^/10

ffdroider discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9737f768f5539cb2a0853f265e4c32a1_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	3732	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9737f768f5539cb2a0853f265e4c32a1_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3732	9737f768f5539cb2a0853f265e4c32a1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9737f768f5539cb2a0853f265e4c32a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9737f768f5539cb2a0853f265e4c32a1_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 1500
  2⤵
  - Program crash
  PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4188,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:8
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3732 -ip 3732
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
8c3f491e2842587f58e98715628f873b

SHA1
669fa736c24f065b7cda033b861836f95806dfe3

SHA256
dd1257fa2585b33d2102eb7476c9d5b8122993275731d88ba75eb02f165b28b5

SHA512
e905e90c63ea476e0c668487d49cb330015b36076a75eb7be7d75d33037061e361cd016de4afbf31bd5393707e4fa1d75d71febbef1127ed8d59162788a8a709

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
1d17e04ecf92bcfb7149d58d6dfb273c

SHA1
636f18b93ef64fe58fc8eeb69f239a48b2f2e24b

SHA256
81e3d12157c3fed3a74abba2469c3faf7b2428878a40ad790cebbd998b4cc376

SHA512
32d96e413820bbb3610a8c38d184b3e2d1afceda6afe189f346a23927f4381b4e88212f261a541adb75d0ce54310f08070041be0c4450b87ea355497c114d1d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
a8314ae1a906b58f58f0d26b19f16d42

SHA1
97e8313cd34f79b00b097dbe29a60a51e803942a

SHA256
43cb61971ca8f70fcf06ec9dad62bded0dbec0b4bc5e0469ffc664d1391bca38

SHA512
c675b83be3c4de0feeeb695e1dc8b5589dcbe2298f6fc800898db152aee0170961487c0930267df163bc17701e78848fa06f7c29069ac461e369ef7052a5cb26

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
166d30103ef57da896331adb1a13964d

SHA1
41c8f7786fd1f8f279168bc3a138d5651d315bb1

SHA256
c1565f239cba456549d98c96fdaac873ceb5389efecad191857718cde6e955f7

SHA512
02b8bfb57b7b59d4f6222ab2c2a4bef2239523927e3836e36c661f69e42a58693def3d39eb020062478c8ee956dc44cf2e6e8527c6c2809955a65bd3679f5b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
83a67a83ed98a1c79a2dfcb38ccf7689

SHA1
4bd4829230f8ececd2f707ecef278274f5ff55e1

SHA256
15cf63c8ec680648e323c20f28335a7180c8aa34db152f35d6f477615cfcbe50

SHA512
a26343664ad7d8cec3d7ff813be3ead8feb4d5a6110ebcc2d132a2aa63883c570d23e3968c827cc705e7e753643393214b35aa8771c9c17618f01a3a8fbf6882

Download Submit
memory/3732-26-0x0000000004600000-0x0000000004608000-memory.dmp

Filesize
32KB

Download
memory/3732-47-0x0000000004600000-0x0000000004608000-memory.dmp

Filesize
32KB

Download
memory/3732-23-0x00000000044F0000-0x00000000044F8000-memory.dmp

Filesize
32KB

Download
memory/3732-24-0x00000000048A0000-0x00000000048A8000-memory.dmp

Filesize
32KB

Download
memory/3732-25-0x00000000047A0000-0x00000000047A8000-memory.dmp

Filesize
32KB

Download
memory/3732-0-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3732-19-0x0000000004250000-0x0000000004258000-memory.dmp

Filesize
32KB

Download
memory/3732-39-0x00000000041B0000-0x00000000041B8000-memory.dmp

Filesize
32KB

Download
memory/3732-17-0x00000000041B0000-0x00000000041B8000-memory.dmp

Filesize
32KB

Download
memory/3732-22-0x0000000004390000-0x0000000004398000-memory.dmp

Filesize
32KB

Download
memory/3732-49-0x0000000004730000-0x0000000004738000-memory.dmp

Filesize
32KB

Download
memory/3732-16-0x0000000004190000-0x0000000004198000-memory.dmp

Filesize
32KB

Download
memory/3732-62-0x00000000041B0000-0x00000000041B8000-memory.dmp

Filesize
32KB

Download
memory/3732-9-0x00000000036E0000-0x00000000036F0000-memory.dmp

Filesize
64KB

Download
memory/3732-70-0x0000000004730000-0x0000000004738000-memory.dmp

Filesize
32KB

Download
memory/3732-72-0x0000000004600000-0x0000000004608000-memory.dmp

Filesize
32KB

Download
memory/3732-3-0x0000000003540000-0x0000000003550000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing