Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 21:33
Static task
static1
Behavioral task
behavioral1
Sample
97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nrxdd.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nrxdd.dll
Resource
win10v2004-20231215-en
General
-
Target
97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe
-
Size
457KB
-
MD5
97bc9fc82cdd0607f0bd1e83622b80ba
-
SHA1
b066758974a6efef88abd3e772171a4bab89d1e8
-
SHA256
7a12f38cc2bd503f9667620f86315281e8319f9f2dca72aa19eb19ff6f3629a6
-
SHA512
b81cf826017f05a7a1d4fa42e61a0da20cbb5b7f02a90881bcdc01f24b64b1880f7078328082d29d9b3fbd957de8fff164f23b0f564fb7f41128841ed7b9ccc2
-
SSDEEP
6144:FBlL/H4sYGXW+W9PTqKkq0KjtS8AE5gktrPnO1+RJRUw167GVRiG62:TKGXW+WJTe8xSAgktTOoRJ+wCSkG5
Malware Config
Extracted
xloader
2.5
b65i
leofighters.com
smartat2.xyz
encontrevariedades.com
jimwilliamstutoring.com
kanpaiecuador.com
accura-inv.com
xtzgjxzz.com
scentstrategies.com
high-clicks2.com
hadishgebray.com
woodlawnbailbonds.com
dmsolutionsco.com
rdvulm21.com
beachyweens.com
ishirmansingh.com
rimmasbracelets.com
kellibrat.com
roselmasm.com
datkamoney.info
fermers.club
veytrex.com
bigfussblog.com
seehow3.com
howtosellhighticket.com
gv-china.com
midatlanticbaths.com
peoplexplants.com
xinhe138.com
peoplefirstflorida.com
lk-safe-keepingtoyof4.xyz
lavish-hika.com
thefooddrone.com
lowkeymastery.com
ferratahvar.com
ntgc.glass
ctfeldsine.com
131inwood.com
austinfishandchicken.com
adambridewell.com
starzara.com
pillfinancialliteracy.com
urlos.store
coralhide.com
y6pw.xyz
palazzoloan.com
peoplesadvantage.net
konzertmanagement.com
alphapat-sa.com
moresatisfy.club
sexynailcompany.com
janlgesnetwork.net
manifestingiam.com
vehicaldashino.com
jazminsalym.com
strtplay2day.info
insureagainstearthquake.com
sddn57.xyz
staygood.gmbh
paymentssecureweb.com
gee-law.com
tenloe098.xyz
mikevideodirection.online
povital.com
ktrtaiwan.com
onewebuy.net
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2680-9-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exepid process 2256 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exedescription pid process target process PID 2256 set thread context of 2680 2256 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exepid process 2680 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exedescription pid process target process PID 2256 wrote to memory of 2680 2256 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe PID 2256 wrote to memory of 2680 2256 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe PID 2256 wrote to memory of 2680 2256 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe PID 2256 wrote to memory of 2680 2256 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe PID 2256 wrote to memory of 2680 2256 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe PID 2256 wrote to memory of 2680 2256 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe PID 2256 wrote to memory of 2680 2256 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe 97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD55a5c717c752014c115f8cd5269d09230
SHA19e98b8f7fc33c2a635b7fafae816e70a991db637
SHA256bbd19853959f6a7e000b9bd1880416753f9129294efc7b5eba835891b4034459
SHA512350f82e6eda8687197d911cddd6d84f734e77f63d538062c49298076db297907643f8771544000d4697d5c3f3995b488ef787a5ba132c89f6b2fba6b5be9a361