Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 09:17
Static task
static1
Behavioral task
behavioral1
Sample
26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe
-
Size
178KB
-
MD5
26cff768bdc099ab279b80fc393b765d
-
SHA1
0d22834c3916ed28d06b88a758176f33c75a8fe5
-
SHA256
c0dd3080dc942f6c41c3ae2dacc82b113bab3fd7a88ab5240b36f3d026098ec7
-
SHA512
fb69c6e4cbf6d104297f497edef2cbfabf1811a8f8c6a508754ba1db59df047f3b91602835a7c022601485c3fee57ad2beff72bcb0fe4bff85f494948cb74f0d
-
SSDEEP
3072:Sl/qvxMEy+ySG1GneljQDcI04v0QhCXUAwn+Je:sSxMEy+ySG1GneyDc14sEJn+0
Malware Config
Extracted
pony
http://222.255.28.16:8080/pony/gate.php
http://88.119.29.2:8080/pony/gate.php
-
payload_url
http://ottolife.com.br/7qyLRunm/HQHUG2V.exe
http://comehomeonline.com/eXTo438J/btVSV.exe
http://tmaurice.com/Ud2agJws/dQfu.exe
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exedescription pid process Token: SeImpersonatePrivilege 3160 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeTcbPrivilege 3160 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 3160 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeCreateTokenPrivilege 3160 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeBackupPrivilege 3160 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeRestorePrivilege 3160 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3160 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 3160 26cff768bdc099ab279b80fc393b765d_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3160-1-0x0000000001FA0000-0x0000000001FD0000-memory.dmpFilesize
192KB
-
memory/3160-2-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3160-0-0x0000000001F80000-0x0000000001F97000-memory.dmpFilesize
92KB
-
memory/3160-5-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB