Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-09-2024 23:17

General

  • Target

    03972c7f3b0df942d4e0a1e11956e523_JaffaCakes118.exe

  • Size

    884KB

  • MD5

    03972c7f3b0df942d4e0a1e11956e523

  • SHA1

    55675cc5594b4731ab268fa2e1ff35df892de7df

  • SHA256

    42c682af79cf1b73127ebf00349a8c4cabccdf42d2e14f77cda67121f870d8bf

  • SHA512

    2d3b1865a41cbf9d6d909d481e7275ff0adda1b8a404b1015e9ff74c943509cdd490ebb5252301609f12f75c392275bc382b21d9044c86d0aef394c937b43ca1

  • SSDEEP

    12288:PdjGXt2ghPHK7zt4QKvq7Mlax3UAXynyGPl+U8av4ORx:VGXt2g4R3Kvsl3XOd8LC

Malware Config

Extracted

Family

oski

C2

soitaab.co/make/

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03972c7f3b0df942d4e0a1e11956e523_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\03972c7f3b0df942d4e0a1e11956e523_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pxOIUAzyZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D1D.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4000
    • C:\Users\Admin\AppData\Local\Temp\03972c7f3b0df942d4e0a1e11956e523_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\03972c7f3b0df942d4e0a1e11956e523_JaffaCakes118.exe"
      2⤵
        PID:3808
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1312
          3⤵
          • Program crash
          PID:1044
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3808 -ip 3808
      1⤵
        PID:3688

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        58.55.71.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        58.55.71.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        77.190.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        77.190.18.2.in-addr.arpa
        IN PTR
        Response
        77.190.18.2.in-addr.arpa
        IN PTR
        a2-18-190-77deploystaticakamaitechnologiescom
      • flag-us
        DNS
        68.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        68.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        97.17.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        97.17.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        228.249.119.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.249.119.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        26.165.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.165.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        soitaab.co
        03972c7f3b0df942d4e0a1e11956e523_JaffaCakes118.exe
        Remote address:
        8.8.8.8:53
        Request
        soitaab.co
        IN A
        Response
      No results found
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
        90 B
        1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        58.55.71.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        58.55.71.13.in-addr.arpa

      • 8.8.8.8:53
        77.190.18.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        77.190.18.2.in-addr.arpa

      • 8.8.8.8:53
        68.32.126.40.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        68.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        97.17.167.52.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        97.17.167.52.in-addr.arpa

      • 8.8.8.8:53
        228.249.119.40.in-addr.arpa
        dns
        73 B
        159 B
        1
        1

        DNS Request

        228.249.119.40.in-addr.arpa

      • 8.8.8.8:53
        26.165.165.52.in-addr.arpa
        dns
        72 B
        146 B
        1
        1

        DNS Request

        26.165.165.52.in-addr.arpa

      • 8.8.8.8:53
        206.23.85.13.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        206.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        soitaab.co
        dns
        03972c7f3b0df942d4e0a1e11956e523_JaffaCakes118.exe
        56 B
        121 B
        1
        1

        DNS Request

        soitaab.co

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp6D1D.tmp

        Filesize

        1KB

        MD5

        274829b2a63e49fc802130c9a773b4cf

        SHA1

        031c25224cad796e393e3012bac87114016e554c

        SHA256

        b434d1bbbd7169c84dff7cc2e8748c2cfcfa7d0e0e718dab9a84cb55a95ba1e4

        SHA512

        ebad3730dea9df41d0a24fce860196ef22321659078780cb8adf181fb75ccaa2733fa7faeb3087fc5357047870b1b0183407cca11840b43f4831811bb39d58bc

      • memory/3808-26-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

      • memory/3808-22-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

      • memory/3808-21-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

      • memory/3808-19-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

      • memory/3808-18-0x0000000000400000-0x0000000000438000-memory.dmp

        Filesize

        224KB

      • memory/4236-5-0x0000000004F90000-0x0000000004F9A000-memory.dmp

        Filesize

        40KB

      • memory/4236-6-0x0000000005270000-0x00000000052C6000-memory.dmp

        Filesize

        344KB

      • memory/4236-8-0x00000000055D0000-0x00000000055E6000-memory.dmp

        Filesize

        88KB

      • memory/4236-9-0x000000007458E000-0x000000007458F000-memory.dmp

        Filesize

        4KB

      • memory/4236-10-0x0000000074580000-0x0000000074D30000-memory.dmp

        Filesize

        7.7MB

      • memory/4236-11-0x0000000006ED0000-0x0000000006F74000-memory.dmp

        Filesize

        656KB

      • memory/4236-12-0x0000000009570000-0x00000000095A8000-memory.dmp

        Filesize

        224KB

      • memory/4236-7-0x0000000074580000-0x0000000074D30000-memory.dmp

        Filesize

        7.7MB

      • memory/4236-0-0x000000007458E000-0x000000007458F000-memory.dmp

        Filesize

        4KB

      • memory/4236-4-0x0000000005040000-0x00000000050D2000-memory.dmp

        Filesize

        584KB

      • memory/4236-3-0x00000000055F0000-0x0000000005B94000-memory.dmp

        Filesize

        5.6MB

      • memory/4236-2-0x0000000004FA0000-0x000000000503C000-memory.dmp

        Filesize

        624KB

      • memory/4236-23-0x0000000074580000-0x0000000074D30000-memory.dmp

        Filesize

        7.7MB

      • memory/4236-1-0x0000000000500000-0x00000000005E4000-memory.dmp

        Filesize

        912KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.