Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 21:31
Static task
static1
Behavioral task
behavioral1
Sample
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe
-
Size
494KB
-
MD5
108d9f901a58b91dea720c89bdaf6424
-
SHA1
27c84fd7da3576f056d3c216cc1602839b6afaa4
-
SHA256
7ec1e15224d90dfaf4898e771aa9997de11ad6794dce01f6c7d8b8cf479eb0fa
-
SHA512
e33be9e7465239f07ffadf9439abe8d12aacab55587f8cf8a7f3e8fa0d64bb76abcfc5b71dbfc7710b871b55145292d6cff89d827e96d413f66d33d7d9b8555d
-
SSDEEP
12288:zIwKYKwWHGKS8R2jLmgyKlIPoI6sG7I9LKpOjSSbwUw:ZeGtXDyRP6JF7
Malware Config
Extracted
xloader
2.5
cuig
sofiathinks-elderly.net
lahamicoast.info
2shengman.com
cbsautoplex.com
arcana-candles.com
genrage.com
kukumiou.xyz
thequizerking.com
sonataproductions.com
rebuildgomnmf.xyz
ubcoin.store
yiyouxue.net
firstlifehome.com
mdx-inc.net
gotbn-c01.com
dinobrindes.store
jcm-iso.com
cliente-mais.com
mloujewelry.com
correoversoi.quest
rc-rental-housing.com
swisstrustcitybank.com
traderjoes-corp.com
mandolinmeditations.com
kathcorp.com
mcdonaldsfastdel.xyz
nielsqanalytics.com
bansity.com
mimosymas.com
atp-cayenne.com
sinterekes.com
nnxsk.com
shushigallery.tech
thgn41.xyz
resporn.tech
growingki.com
themyopiatoolbox.com
angeleyesevents.com
reddishgomjtd.xyz
amazonretailbrickandmotar.net
jewelrybyjma.com
ctroutdoors.pro
357961.com
theakfam.business
skincarefamily.com
xptoempeendimentos.com
tapestrirewards.com
viridilodge.com
bostondowntownrealestate.com
disrepairclaimsuk.com
makaroff.net
thedoublezbar.com
barbicidemalaysia.com
sliv-a.online
showgeini.com
martialartsreigns.online
metamode.space
ch95516.ink
halvorson-pickup.com
mizuno-trouble.net
46dgj.xyz
esylf4vt.xyz
chopaap.com
igorleonardo.com
qtih.top
Signatures
-
Xloader payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2392-11-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2392-14-0x0000000000850000-0x0000000000B53000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exedescription pid process target process PID 2456 set thread context of 2392 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exepid process 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 2392 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exedescription pid process target process PID 2456 wrote to memory of 2392 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 2456 wrote to memory of 2392 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 2456 wrote to memory of 2392 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 2456 wrote to memory of 2392 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 2456 wrote to memory of 2392 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 2456 wrote to memory of 2392 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 2456 wrote to memory of 2392 2456 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2392-7-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2392-14-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB
-
memory/2392-13-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB
-
memory/2392-11-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2392-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2392-8-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2456-3-0x0000000000AA0000-0x0000000000AAE000-memory.dmpFilesize
56KB
-
memory/2456-6-0x00000000047E0000-0x0000000004832000-memory.dmpFilesize
328KB
-
memory/2456-5-0x0000000007050000-0x0000000007090000-memory.dmpFilesize
256KB
-
memory/2456-4-0x0000000074B20000-0x000000007520E000-memory.dmpFilesize
6.9MB
-
memory/2456-0-0x0000000000E40000-0x0000000000EC0000-memory.dmpFilesize
512KB
-
memory/2456-12-0x0000000074B20000-0x000000007520E000-memory.dmpFilesize
6.9MB
-
memory/2456-2-0x0000000007050000-0x0000000007090000-memory.dmpFilesize
256KB
-
memory/2456-1-0x0000000074B20000-0x000000007520E000-memory.dmpFilesize
6.9MB