Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31-03-2024 22:57
Static task
static1
Behavioral task
behavioral1
Sample
607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe
-
Size
560KB
-
MD5
607afbfc6f90d724bd7014ca4ab30be5
-
SHA1
594b0adbea0f4145f234d862ac1c2fed4c7b638a
-
SHA256
f6d328b383e179f3c0918c3e97964151319444ea9f22e0d667c831dfe8d26069
-
SHA512
97db713be3938363e3776562608cc99c51ed1505b1ed839a164234e12fa1cf283bd1900b431e53d32a67c3a7c194ce1d9f1286bebef6903294a35d41bdbea6c4
-
SSDEEP
12288:ug109D6dlL1G/mbwapy8gSBZQpFotwgNvV:ug0J6EmbwUyoBZLtt
Malware Config
Extracted
xloader
2.5
wogm
sub-dude.net
repeatcustom.com
goodspaz.com
sinagropuree.com
jyh8886.com
muescabynes.quest
stark.agency
nolimit168.com
hypermediastore.com
arab-xt-pro.com
gruppovimar.com
santamariamoto.express
affaridistribuciones.com
straetah.com
collectionsbyvivi.com
nalainteriores.com
weeklywars.com
insightmyhome.com
ucml.net
herderguru.com
sz-jialejia.com
xinglu56.com
tenselect.net
arepaspuesdc.com
cvkf.email
moseslakeapartment.com
chantaldesign.space
884651.com
yzyf88.com
seattlecanna.com
obsessive.company
blessedfurnitures.com
disparandose.com
smmakrygiannakis.online
buno8ce.com
javaportal.info
laoqu6666.com
portfolioinsidertips.com
workospbit.space
biocrafts.net
estebancantillo.com
appliancestar.xyz
gloriousbees.xyz
porchlightwoodworks.com
rawhoneytnpasumo2.xyz
pokipass-niigata.com
aodesai.store
powro.online
playin.one
minded-afoot.com
zpahura.com
bodybybetsy.com
camworker.cloud
mest2.com
chezlulu.paris
officeupdate365.com
jackdanska.com
glenndcp.com
huikanvip.com
connectedtoolstore.com
flogicpro.com
yourhomestimate.com
dogtraining5x5.com
truenettnpasumo2.xyz
eygtogel021.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2996-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exedescription pid process target process PID 2368 set thread context of 2996 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exepid process 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 2996 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exedescription pid process target process PID 2368 wrote to memory of 3012 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe PID 2368 wrote to memory of 3012 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe PID 2368 wrote to memory of 3012 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe PID 2368 wrote to memory of 3012 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe PID 2368 wrote to memory of 2996 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe PID 2368 wrote to memory of 2996 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe PID 2368 wrote to memory of 2996 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe PID 2368 wrote to memory of 2996 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe PID 2368 wrote to memory of 2996 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe PID 2368 wrote to memory of 2996 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe PID 2368 wrote to memory of 2996 2368 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe 607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe"2⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\607afbfc6f90d724bd7014ca4ab30be5_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2996