Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 09:17
Static task
static1
Behavioral task
behavioral1
Sample
26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe
-
Size
178KB
-
MD5
26cff768bdc099ab279b80fc393b765d
-
SHA1
0d22834c3916ed28d06b88a758176f33c75a8fe5
-
SHA256
c0dd3080dc942f6c41c3ae2dacc82b113bab3fd7a88ab5240b36f3d026098ec7
-
SHA512
fb69c6e4cbf6d104297f497edef2cbfabf1811a8f8c6a508754ba1db59df047f3b91602835a7c022601485c3fee57ad2beff72bcb0fe4bff85f494948cb74f0d
-
SSDEEP
3072:Sl/qvxMEy+ySG1GneljQDcI04v0QhCXUAwn+Je:sSxMEy+ySG1GneyDc14sEJn+0
Malware Config
Extracted
pony
http://222.255.28.16:8080/pony/gate.php
http://88.119.29.2:8080/pony/gate.php
-
payload_url
http://ottolife.com.br/7qyLRunm/HQHUG2V.exe
http://comehomeonline.com/eXTo438J/btVSV.exe
http://tmaurice.com/Ud2agJws/dQfu.exe
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exedescription pid process Token: SeImpersonatePrivilege 1984 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeTcbPrivilege 1984 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1984 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeCreateTokenPrivilege 1984 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeBackupPrivilege 1984 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeRestorePrivilege 1984 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 1984 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 1984 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exepid process 1984 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1984-0-0x0000000000280000-0x0000000000297000-memory.dmpFilesize
92KB
-
memory/1984-1-0x00000000002A0000-0x00000000002D0000-memory.dmpFilesize
192KB
-
memory/1984-2-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1984-3-0x00000000002A0000-0x00000000002D0000-memory.dmpFilesize
192KB
-
memory/1984-4-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB