Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01-04-2024 04:55
Static task
static1
Behavioral task
behavioral1
Sample
6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe
-
Size
981KB
-
MD5
6850ea10453df9ba55f19aaab9322445
-
SHA1
55daafbcb4e4ccd9b64802dae321d31660d2502d
-
SHA256
cdf04db4f38a3af95ce0441810eaa0919ec5b5f61d53976a8dcd2469d134de79
-
SHA512
6756a6639ba95942c3c0fd6c237f8f281a301ab17c0f49499a967c5d674846e1173048b04ab79a977738247d04c255086adcb6517bcadb34e342738db572cd6e
-
SSDEEP
24576:vWNWgJJKiiXCxh8eC/9qS64JGIS543eHS4PP0:vWWmKMgtJGIh6S4E
Malware Config
Extracted
xloader
2.5
g91q
familiengeschichtsforschung.com
brandingperspective.com
qctxcyagmn.com
gabrielecancilla.com
consultjenhome.com
raquelshaye.com
catix.store
cafemargaritastreet.com
649521.com
jhugiugiyfogiyfof.space
ktnspace.xyz
server-ku.com
dlatrxs.com
answertitles.com
tyzdia.com
thedavidhearne.com
verbenalifestyle.com
eniso-team.com
xn--jger-loa.media
ejassatuenam.xyz
papayacalifornia.com
grassinstall.com
elishevazz.com
houstonorganicpestcontrol.com
callaloorecipes.com
eddupdate-secure.com
plux.agency
scjeda.net
thehomeworkouts.com
reserveahotspot.com
hzgdry.com
australiaown.com
tes5ci.com
tiktokraises.com
officialstreetstash.com
privateratings.com
ndjek21.com
6863.online
vpgp.net
90885501.com
padel-ledverlichting.com
centsofpurposellc.com
2t510e.com
nursingrehab.net
nataliz.com
silvercurlstudio.com
theafterfive.com
uscarcadia.com
580467.com
jamvl.com
silvanagarciadespachante.com
furtherpklmyk.xyz
halal4babies.com
sousoujiangsu.com
knellarraywoad.com
edittrax.com
glaverflinte.quest
yukokom.business
ronaldoecom.com
petcurioso.com
guanglong81.com
bookcokids.com
xjqysjj.com
mobilestallbd.com
comercialjyv.com
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2316-2-0x0000000004D50000-0x0000000004E46000-memory.dmp family_zgrat_v1 -
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2816-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exedescription pid process target process PID 2316 set thread context of 2816 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exepid process 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 2816 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exedescription pid process target process PID 2316 wrote to memory of 2816 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe PID 2316 wrote to memory of 2816 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe PID 2316 wrote to memory of 2816 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe PID 2316 wrote to memory of 2816 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe PID 2316 wrote to memory of 2816 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe PID 2316 wrote to memory of 2816 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe PID 2316 wrote to memory of 2816 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe PID 2316 wrote to memory of 2816 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe PID 2316 wrote to memory of 2816 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe PID 2316 wrote to memory of 2816 2316 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe 6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\6850ea10453df9ba55f19aaab9322445_JaffaCakes118.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2816