Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/04/2024, 16:30
General
- Target e55bf27e175b5841bc948e58bc2c13ac_JaffaCakes118.exe
- Size 373KB
- Sample240407-tz2wdaha95
- SHA256 c49decb0015b632d6b624ebe0486c342ac7b3e05332b03509558cadb1c705c38
Malware Config
Extracted
-
xloader
-
2.3
-
nins
-
wingsmh.com
-
honeyconstructionmanagement.com
-
aizaibali.com
-
twelve11transportsllc.com
-
aadetermatology.com
-
sarahdewald.com
-
si-kap.online
-
imperiummetal.site
-
srysyoga.com
-
fbirelationship.com
-
drtracielashley.academy
-
jrgsestates.com
-
affordableseo.club
-
triggerfingerboards.com
-
halalmine.com
-
shopdogwoodhill.com
-
qad.info
-
nocraphere.com
-
misskarennglishteacher.com
-
march.wtf
Signatures
- Detect ZGRat V1 34 IoCs
- Xloader
Xloader is a rebranded version of Formbook malware.
- ZGRat
ZGRat is remote access trojan written in C#.
- Xloader payload 6 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 61 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e55bf27e175b5841bc948e58bc2c13ac_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e55bf27e175b5841bc948e58bc2c13ac_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\e55bf27e175b5841bc948e58bc2c13ac_JaffaCakes118.exe" -Force3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\e55bf27e175b5841bc948e58bc2c13ac_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e55bf27e175b5841bc948e58bc2c13ac_JaffaCakes118.exe3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FB_6A7D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_6A7D.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\FB_6BB6.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_6BB6.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\FB_6A7D.tmp.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
FB_6A7D.tmp.exe
FB_6BB6.tmp.exe
__PSScriptPolicyTest_lnvdxfol.d4x.ps1
memory/692-2179-0x0000000007630000-0x0000000007CAA000-memory.dmp
memory/692-2159-0x0000000005960000-0x00000000059C6000-memory.dmp
memory/692-2135-0x00000000026B0000-0x00000000026E6000-memory.dmp
memory/692-2139-0x0000000004C80000-0x0000000004C90000-memory.dmp
memory/692-2142-0x0000000004C80000-0x0000000004C90000-memory.dmp
memory/692-2143-0x00000000052C0000-0x00000000058E8000-memory.dmp
memory/692-2188-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/692-2185-0x00000000065B0000-0x00000000065D2000-memory.dmp
memory/692-2184-0x0000000007250000-0x00000000072E6000-memory.dmp
memory/692-2147-0x0000000004F30000-0x0000000004F52000-memory.dmp
memory/692-2178-0x0000000006010000-0x000000000605C000-memory.dmp
memory/692-2172-0x0000000005A40000-0x0000000005D94000-memory.dmp
memory/692-2180-0x00000000064F0000-0x000000000650A000-memory.dmp
memory/692-2137-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/692-2177-0x0000000005FE0000-0x0000000005FFE000-memory.dmp
memory/1088-2195-0x0000000000FC0000-0x0000000001050000-memory.dmp
memory/1088-2193-0x0000000001290000-0x00000000015DA000-memory.dmp
memory/1088-2199-0x00000000007D0000-0x00000000007F9000-memory.dmp
memory/1088-2192-0x00000000007D0000-0x00000000007F9000-memory.dmp
memory/1088-2191-0x0000000000840000-0x000000000084B000-memory.dmp
memory/3428-2205-0x00000000093A0000-0x00000000094B3000-memory.dmp
memory/3428-2175-0x0000000007AA0000-0x0000000007B98000-memory.dmp
memory/3428-2197-0x0000000009000000-0x000000000913A000-memory.dmp
memory/3428-2183-0x0000000009000000-0x000000000913A000-memory.dmp
memory/3428-2201-0x00000000093A0000-0x00000000094B3000-memory.dmp
memory/4440-2173-0x0000000001810000-0x0000000001B5A000-memory.dmp
memory/4440-2182-0x0000000003440000-0x0000000003451000-memory.dmp
memory/4440-2176-0x0000000000AC0000-0x0000000000AE9000-memory.dmp
memory/4440-2181-0x0000000000AC0000-0x0000000000AE9000-memory.dmp
memory/4440-2174-0x0000000001220000-0x0000000001231000-memory.dmp
memory/4696-2141-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4992-31-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-35-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-63-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-65-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-67-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-70-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-69-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4992-72-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-1559-0x00000000053C0000-0x00000000053D0000-memory.dmp
memory/4992-2132-0x0000000001100000-0x0000000001166000-memory.dmp
memory/4992-59-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-57-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-55-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-53-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-51-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-49-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-2145-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4992-47-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-45-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-43-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-41-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-39-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-37-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-61-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-9-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-33-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-0-0x0000000000A20000-0x0000000000A84000-memory.dmp
memory/4992-19-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-21-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-23-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-29-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-25-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-27-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-11-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-17-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-13-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-15-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-8-0x0000000006850000-0x00000000068B8000-memory.dmp
memory/4992-7-0x0000000006850000-0x00000000068BE000-memory.dmp
memory/4992-6-0x0000000006670000-0x00000000066D0000-memory.dmp
memory/4992-5-0x0000000005470000-0x000000000547A000-memory.dmp
memory/4992-4-0x00000000053C0000-0x00000000053D0000-memory.dmp
memory/4992-3-0x00000000054B0000-0x0000000005542000-memory.dmp
memory/4992-2-0x00000000059C0000-0x0000000005F64000-memory.dmp
memory/4992-1-0x00000000749C0000-0x0000000075170000-memory.dmp