Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 15:39
Static task
static1
Behavioral task
behavioral1
Sample
25e0d7d8ec7b207b6084348d872db814_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
25e0d7d8ec7b207b6084348d872db814_JaffaCakes118.exe
-
Size
358KB
-
MD5
25e0d7d8ec7b207b6084348d872db814
-
SHA1
3c573c3e4d06748905be128eeb1214eae8a4aded
-
SHA256
00a9f766c47eed9e7b5eb6069a7803bd215ad5513865d675c0e6befb75c4ee0c
-
SHA512
84b344a0bd5bfa0df07d0c90d5a796c85d8ef6b60dfd8fbe662a77aeebe07f1713c2af2e54e8ddcf351fb39076c30dff1a3a063b5091ea202967234a3707d4a3
-
SSDEEP
6144:J+ka80Y2N8IOrJPAZub35+4NsPOrpz/Kc0zGqqX7tNfVXVHQLIiu8cfo0/pW:Jxa8V2N8IVUJ+iAOSzVwZGEX8cA0/M
Malware Config
Extracted
xloader
2.5
bs8f
vasilnikov.com
parkate.club
pol360.com
handmadequatang.com
consult-set.com
nourkoki.com
theveganfusspot.com
dreamssail.com
pinpinyouqian.xyz
satellitphonestore.com
yotosunny.com
telosaolympics.com
gogetemm.com
yozotnpasumo2.xyz
avantgardemarket.com
glenndcp.com
dirtydriverz.com
avaui.com
anchoredtheblog.com
marianaoliveiraarquitetura.com
dadaman.com
hackensackvet.com
onelovecafeatl.com
top-recordtodiscovertoday.info
goodzza.net
gideonajibike.com
2010.pro
room1029.com
tucochepordinero.net
natsuyagimaki.com
daleproaudio.xyz
cryptoregulations.xyz
vmini.info
bukketfantom.quest
sgpvbzw.com
straightii.com
exploitgomyau.xyz
cvwerg.com
sikiich.com
anchoramolnile.com
eljkj.com
leroyalstevenson.com
narae-digital.com
swalayan.digital
market1c.store
vitaminecrew.com
sirabeyo.net
bornholm-urlaub.info
michael-ludwig.info
innoattic.com
cupandthoughts.com
ppd-mall.com
sponsoredcrew.com
cardiopulmonaryservices.com
ff4ciib4q.xyz
xn--kzlarndkkan-zhb69deah.com
saint444.com
serc0-na.com
idecor.asia
zombiesoflalaland.com
medinaes.xyz
deluxhaus.com
alwaysmode.com
lastpassword.net
rwilogisticsandbrokerage.com
Signatures
-
Xloader payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4280-2-0x0000000004C70000-0x0000000004C99000-memory.dmp xloader behavioral2/memory/4280-4-0x0000000000400000-0x0000000002F24000-memory.dmp xloader behavioral2/memory/4280-5-0x0000000004C70000-0x0000000004C99000-memory.dmp xloader -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3956 4280 WerFault.exe 25e0d7d8ec7b207b6084348d872db814_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25e0d7d8ec7b207b6084348d872db814_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\25e0d7d8ec7b207b6084348d872db814_JaffaCakes118.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 2802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4280 -ip 42801⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4280-1-0x0000000002F40000-0x0000000003040000-memory.dmpFilesize
1024KB
-
memory/4280-2-0x0000000004C70000-0x0000000004C99000-memory.dmpFilesize
164KB
-
memory/4280-4-0x0000000000400000-0x0000000002F24000-memory.dmpFilesize
43.1MB
-
memory/4280-5-0x0000000004C70000-0x0000000004C99000-memory.dmpFilesize
164KB