oski | 5ef0850150c577b7184b16ca066af5322d280d6e4208b8cb2d8059c8fdcd1da2

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-04-2024 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5351dc8fbec2f874e623c30e719c48b_JaffaCakes118.ps1
Size

421KB
MD5

e5351dc8fbec2f874e623c30e719c48b
SHA1

af756d841b0e9bc3accc58561f97111351dc4719
SHA256

5ef0850150c577b7184b16ca066af5322d280d6e4208b8cb2d8059c8fdcd1da2
SHA512

204dd0f88dd1085a616fc611e3b4e49c7d974e1c70eb110c19b040100faf1d8ba699ec3735f7b90cf664e980907878d3ee7e45ce689557ba85d677d1ed5c6c76
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64sL68:q3n

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

/103.114.107.28/l2323/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2172 set thread context of 2684 2172 powershell.exe MSBuild.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2500 2684 WerFault.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2172 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2172 powershell.exe

description	pid	process	target process
PID 2172 set thread context of 2684	2172	powershell.exe	MSBuild.exe

pid	pid_target	process	target process
2500	2684	WerFault.exe	MSBuild.exe

pid	process
2172	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2172	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

powershell.exeMSBuild.exe

description	pid	process	target process
PID 2172 wrote to memory of 2684	2172	powershell.exe	MSBuild.exe
PID 2172 wrote to memory of 2684	2172	powershell.exe	MSBuild.exe
PID 2172 wrote to memory of 2684	2172	powershell.exe	MSBuild.exe
PID 2172 wrote to memory of 2684	2172	powershell.exe	MSBuild.exe
PID 2172 wrote to memory of 2684	2172	powershell.exe	MSBuild.exe
PID 2172 wrote to memory of 2684	2172	powershell.exe	MSBuild.exe
PID 2172 wrote to memory of 2684	2172	powershell.exe	MSBuild.exe
PID 2172 wrote to memory of 2684	2172	powershell.exe	MSBuild.exe
PID 2172 wrote to memory of 2684	2172	powershell.exe	MSBuild.exe
PID 2172 wrote to memory of 2684	2172	powershell.exe	MSBuild.exe
PID 2684 wrote to memory of 2500	2684	MSBuild.exe	WerFault.exe
PID 2684 wrote to memory of 2500	2684	MSBuild.exe	WerFault.exe
PID 2684 wrote to memory of 2500	2684	MSBuild.exe	WerFault.exe
PID 2684 wrote to memory of 2500	2684	MSBuild.exe	WerFault.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\e5351dc8fbec2f874e623c30e719c48b_JaffaCakes118.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 500
3⤵
- Program crash
PID:2500

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-4-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2172-5-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2172-7-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2172-6-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/2172-8-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2172-9-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/2172-10-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/2172-11-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/2172-12-0x0000000002D70000-0x0000000002D7A000-memory.dmp

Filesize
40KB

Download
memory/2172-27-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2684-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-26-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-24-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-28-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2684-30-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads