Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 21:31
Static task
static1
Behavioral task
behavioral1
Sample
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe
-
Size
494KB
-
MD5
108d9f901a58b91dea720c89bdaf6424
-
SHA1
27c84fd7da3576f056d3c216cc1602839b6afaa4
-
SHA256
7ec1e15224d90dfaf4898e771aa9997de11ad6794dce01f6c7d8b8cf479eb0fa
-
SHA512
e33be9e7465239f07ffadf9439abe8d12aacab55587f8cf8a7f3e8fa0d64bb76abcfc5b71dbfc7710b871b55145292d6cff89d827e96d413f66d33d7d9b8555d
-
SSDEEP
12288:zIwKYKwWHGKS8R2jLmgyKlIPoI6sG7I9LKpOjSSbwUw:ZeGtXDyRP6JF7
Malware Config
Extracted
xloader
2.5
cuig
sofiathinks-elderly.net
lahamicoast.info
2shengman.com
cbsautoplex.com
arcana-candles.com
genrage.com
kukumiou.xyz
thequizerking.com
sonataproductions.com
rebuildgomnmf.xyz
ubcoin.store
yiyouxue.net
firstlifehome.com
mdx-inc.net
gotbn-c01.com
dinobrindes.store
jcm-iso.com
cliente-mais.com
mloujewelry.com
correoversoi.quest
rc-rental-housing.com
swisstrustcitybank.com
traderjoes-corp.com
mandolinmeditations.com
kathcorp.com
mcdonaldsfastdel.xyz
nielsqanalytics.com
bansity.com
mimosymas.com
atp-cayenne.com
sinterekes.com
nnxsk.com
shushigallery.tech
thgn41.xyz
resporn.tech
growingki.com
themyopiatoolbox.com
angeleyesevents.com
reddishgomjtd.xyz
amazonretailbrickandmotar.net
jewelrybyjma.com
ctroutdoors.pro
357961.com
theakfam.business
skincarefamily.com
xptoempeendimentos.com
tapestrirewards.com
viridilodge.com
bostondowntownrealestate.com
disrepairclaimsuk.com
makaroff.net
thedoublezbar.com
barbicidemalaysia.com
sliv-a.online
showgeini.com
martialartsreigns.online
metamode.space
ch95516.ink
halvorson-pickup.com
mizuno-trouble.net
46dgj.xyz
esylf4vt.xyz
chopaap.com
igorleonardo.com
qtih.top
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4328-11-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exedescription pid process target process PID 3192 set thread context of 4328 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exepid process 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 4328 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 4328 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exedescription pid process target process PID 3192 wrote to memory of 1604 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 3192 wrote to memory of 1604 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 3192 wrote to memory of 1604 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 3192 wrote to memory of 4328 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 3192 wrote to memory of 4328 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 3192 wrote to memory of 4328 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 3192 wrote to memory of 4328 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 3192 wrote to memory of 4328 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe PID 3192 wrote to memory of 4328 3192 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe 108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\108d9f901a58b91dea720c89bdaf6424_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3192-6-0x0000000007650000-0x000000000765E000-memory.dmpFilesize
56KB
-
memory/3192-8-0x0000000007280000-0x0000000007290000-memory.dmpFilesize
64KB
-
memory/3192-2-0x00000000076A0000-0x0000000007C44000-memory.dmpFilesize
5.6MB
-
memory/3192-3-0x00000000070F0000-0x0000000007182000-memory.dmpFilesize
584KB
-
memory/3192-4-0x0000000007280000-0x0000000007290000-memory.dmpFilesize
64KB
-
memory/3192-5-0x0000000004D50000-0x0000000004D5A000-memory.dmpFilesize
40KB
-
memory/3192-1-0x00000000001D0000-0x0000000000250000-memory.dmpFilesize
512KB
-
memory/3192-7-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/3192-0-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/3192-9-0x00000000087F0000-0x000000000888C000-memory.dmpFilesize
624KB
-
memory/3192-10-0x000000000C020000-0x000000000C072000-memory.dmpFilesize
328KB
-
memory/3192-13-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/4328-11-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4328-14-0x0000000001160000-0x00000000014AA000-memory.dmpFilesize
3.3MB
-
memory/4328-15-0x0000000001160000-0x00000000014AA000-memory.dmpFilesize
3.3MB