Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-04-2024 22:48
Static task
static1
Behavioral task
behavioral1
Sample
7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe
-
Size
563KB
-
MD5
7c85aa081fe0719f67f061aed4598cc9
-
SHA1
7eb858e3a7fc408e05c68ba9ed11eee238821ecc
-
SHA256
f611ae8cbc80b35dfde61d8a6de2f2af94f0b97d31e7d58c082205dcae8d0aca
-
SHA512
dc49d2a1a7086fef7d9d26d63850f8c6fe2f27d55802cefad27cd9728d1d7a1c3796f8591b66ff0ab70c47ce8f5f38d49a79f5e0ebed1a035c14ec05611dff47
-
SSDEEP
6144:cKheIEpyb/eDE6j87TZ48zMKf6ZyNN68M07+AGlqtIMdcJDhepYYXN:nEpySIzCKf6ZyNx7/OqtIMyJDheuYd
Malware Config
Extracted
xloader
2.5
mexq
cyebang.com
hcswwsz.com
50003008.com
yfly624.xyz
trungtamhohap.xyz
sotlbb.com
bizhan69.com
brandmty.net
fucibou.xyz
orderinformantmailer.store
nobleminers.com
divinevoid.com
quickappraisal.net
adventuretravelsworld.com
ashainitiativemp.com
ikkbs-a02.com
rd26x.com
goraeda.com
abbastanza.info
andypartridge.photography
xn--aprendes-espaol-brb.com
jrceleste.com
bestwarsawhotels.com
fospine.online
rayofdesign.online
hablamarca.com
nichellejonesrealtor.com
zamarasystem.com
thepropertygoat.com
fightfigures.com
mxconglomerate.com
elecoder.com
mabnapakhsh.com
girlspiter.club
xn--lcka2cufqed6765c4ef1x1g.xyz
cancleaningpros.com
galestorm.net
besrbee.com
sjmdesignstudio.com
kickonlines.com
generateyourart.com
promiseface.com
searchingspacespot.com
jovemmilionario.com
paomovar.com
dogiadunggiare.online
uniqued.net
glassrootsstudio.com
rabenteec.com
asistente-ti.com
xn--l6qw76agwi5rjeuzk9q.com
azapsolutions.com
wmh3gk2fzw2m.biz
districonio.com
dapekdelivery.com
vintagepaseo.com
od0aew1pox.com
iphone13promax.design
texttheruffleddaisy.com
umdasch-lagertechnik.com
growthabove.com
eltacorancherofoodtruck.com
gafoodstamps.com
mzalluom.com
aliexpress-br.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3096-11-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exedescription pid process target process PID 1452 set thread context of 3096 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exepid process 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 3096 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 3096 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exedescription pid process target process PID 1452 wrote to memory of 4256 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe PID 1452 wrote to memory of 4256 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe PID 1452 wrote to memory of 4256 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe PID 1452 wrote to memory of 3096 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe PID 1452 wrote to memory of 3096 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe PID 1452 wrote to memory of 3096 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe PID 1452 wrote to memory of 3096 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe PID 1452 wrote to memory of 3096 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe PID 1452 wrote to memory of 3096 1452 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe 7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe"2⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7c85aa081fe0719f67f061aed4598cc9_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3096