Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 22:42 UTC
Static task
static1
Behavioral task
behavioral1
Sample
fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe
-
Size
82KB
-
MD5
fb089f68b2a69dc8353d485f9f93b3c6
-
SHA1
d5c3b770e53cc064c2d8f5ec3677abfdd1805083
-
SHA256
b3648ecbf8a0f98c037c72bf95915371e135f22dd8602609f8858f07155bb3fb
-
SHA512
68ef61cc8146628b70a9a5e3774d152257a1756b4976952fe277309a51b16c2d209b2dd8b2fe6f7807153dbf74f6cc872f6edcc3f44e52728c3272a6dc9c1166
-
SSDEEP
1536:yQ2KxJp1NqvlrMUp2JE8lkzxKWEkoOwFMHwehKKB02nM7x+1kBCGPnh6Y:cKX1ErPp2JE8KzxK3BFMQeG2nM7xvwGX
Malware Config
Extracted
pony
http://91.230.147.173/internet_pot.php
http://91.230.147.229/internet_pot.php
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3584 set thread context of 5000 3584 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeImpersonatePrivilege 5000 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe Token: SeTcbPrivilege 5000 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 5000 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe Token: SeCreateTokenPrivilege 5000 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe Token: SeBackupPrivilege 5000 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe Token: SeRestorePrivilege 5000 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 5000 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 5000 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3584 wrote to memory of 5000 3584 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe 82 PID 3584 wrote to memory of 5000 3584 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe 82 PID 3584 wrote to memory of 5000 3584 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe 82 PID 3584 wrote to memory of 5000 3584 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe 82 PID 3584 wrote to memory of 5000 3584 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe 82 PID 3584 wrote to memory of 5000 3584 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe 82 PID 3584 wrote to memory of 5000 3584 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe 82 PID 3584 wrote to memory of 5000 3584 fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fb089f68b2a69dc8353d485f9f93b3c6_JaffaCakes118.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request66.209.201.84.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
132 B 90 B 2 1
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
8.8.8.8.in-addr.arpa
-
142 B 145 B 2 1
DNS Request
97.17.167.52.in-addr.arpa
DNS Request
97.17.167.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
71.31.126.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
197.87.175.4.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
72 B 132 B 1 1
DNS Request
66.209.201.84.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa