Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 08:31
Static task
static1
Behavioral task
behavioral1
Sample
e480e28c74a635845673fd030eb47734_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e480e28c74a635845673fd030eb47734_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e480e28c74a635845673fd030eb47734_JaffaCakes118.exe
-
Size
268KB
-
MD5
e480e28c74a635845673fd030eb47734
-
SHA1
913f51d9deee32c6953a3ce9fbe04dd85f4c78f1
-
SHA256
d83a8f3a3475132ef153741a21858652a2f03a4e62d56f6864c8800fb0a0da45
-
SHA512
620d5be5d4874d5f89b2d301e9900fb25c11cf1630c5fd901e8d34e71ea3c467931e3b284bb16309e26a81a79ba1abd945c20ea908917e378fdac356c54e1571
-
SSDEEP
6144:mU2ggwQt/uqv8uLjPMRnuCKc8E46U+mxHYQsl4DrNr1Hzkmct/036YFTKT:mU1HKc8EnIN5ssrNrumcS36Y6
Malware Config
Extracted
oski
nedu1994.xyz
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e480e28c74a635845673fd030eb47734_JaffaCakes118.exedescription pid process target process PID 2044 set thread context of 1208 2044 e480e28c74a635845673fd030eb47734_JaffaCakes118.exe e480e28c74a635845673fd030eb47734_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2032 1208 WerFault.exe e480e28c74a635845673fd030eb47734_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e480e28c74a635845673fd030eb47734_JaffaCakes118.exepid process 2044 e480e28c74a635845673fd030eb47734_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e480e28c74a635845673fd030eb47734_JaffaCakes118.exee480e28c74a635845673fd030eb47734_JaffaCakes118.exedescription pid process target process PID 2044 wrote to memory of 1208 2044 e480e28c74a635845673fd030eb47734_JaffaCakes118.exe e480e28c74a635845673fd030eb47734_JaffaCakes118.exe PID 2044 wrote to memory of 1208 2044 e480e28c74a635845673fd030eb47734_JaffaCakes118.exe e480e28c74a635845673fd030eb47734_JaffaCakes118.exe PID 2044 wrote to memory of 1208 2044 e480e28c74a635845673fd030eb47734_JaffaCakes118.exe e480e28c74a635845673fd030eb47734_JaffaCakes118.exe PID 2044 wrote to memory of 1208 2044 e480e28c74a635845673fd030eb47734_JaffaCakes118.exe e480e28c74a635845673fd030eb47734_JaffaCakes118.exe PID 2044 wrote to memory of 1208 2044 e480e28c74a635845673fd030eb47734_JaffaCakes118.exe e480e28c74a635845673fd030eb47734_JaffaCakes118.exe PID 1208 wrote to memory of 2032 1208 e480e28c74a635845673fd030eb47734_JaffaCakes118.exe WerFault.exe PID 1208 wrote to memory of 2032 1208 e480e28c74a635845673fd030eb47734_JaffaCakes118.exe WerFault.exe PID 1208 wrote to memory of 2032 1208 e480e28c74a635845673fd030eb47734_JaffaCakes118.exe WerFault.exe PID 1208 wrote to memory of 2032 1208 e480e28c74a635845673fd030eb47734_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e480e28c74a635845673fd030eb47734_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e480e28c74a635845673fd030eb47734_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e480e28c74a635845673fd030eb47734_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e480e28c74a635845673fd030eb47734_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 7683⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-6-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1208-5-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1208-3-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1208-7-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1208-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2044-2-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2044-1-0x0000000000090000-0x0000000000190000-memory.dmpFilesize
1024KB