Analysis
- max time kernel
148s - max time network
121s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
- submitted
09/04/2024, 15:52
General
- Target ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
- Size 398KB
- Sample240409-ta714aeh2x
- SHA256 0cb70c2842d361eff4d971e809911969086a71824cc422f98cbc8b924713463f
Malware Config
Extracted
-
xloader
-
2.3
-
nins
-
wingsmh.com
-
honeyconstructionmanagement.com
-
aizaibali.com
-
twelve11transportsllc.com
-
aadetermatology.com
-
sarahdewald.com
-
si-kap.online
-
imperiummetal.site
-
srysyoga.com
-
fbirelationship.com
-
drtracielashley.academy
-
jrgsestates.com
-
affordableseo.club
-
triggerfingerboards.com
-
halalmine.com
-
shopdogwoodhill.com
-
qad.info
-
nocraphere.com
-
misskarennglishteacher.com
-
march.wtf
Signatures
- Detect ZGRat V1 34 IoCs
- Xloader
Xloader is a rebranded version of Formbook malware.
- ZGRat
ZGRat is remote access trojan written in C#.
- Xloader payload 6 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 34 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.83⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FB_E6F5.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_E6F5.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\FB_E754.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_E754.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\FB_E6F5.tmp.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
d93f411851d7c929.customDestinations-ms
FB_E6F5.tmp.exe
FB_E754.tmp.exe
memory/856-2188-0x0000000000320000-0x0000000000331000-memory.dmp
memory/856-2181-0x0000000000990000-0x0000000000C93000-memory.dmp
memory/856-2183-0x0000000000960000-0x0000000000989000-memory.dmp
memory/856-2184-0x0000000000170000-0x0000000000181000-memory.dmp
memory/856-2187-0x0000000000960000-0x0000000000989000-memory.dmp
memory/1152-2200-0x0000000004510000-0x00000000045D6000-memory.dmp
memory/1152-2189-0x0000000004510000-0x00000000045D6000-memory.dmp
memory/1152-2185-0x0000000006370000-0x00000000064D9000-memory.dmp
memory/1652-2195-0x0000000000AA0000-0x0000000000DA3000-memory.dmp
memory/1652-2193-0x00000000000D0000-0x00000000000F9000-memory.dmp
memory/1652-2192-0x0000000000EA0000-0x0000000000EB6000-memory.dmp
memory/1652-2197-0x0000000000910000-0x00000000009A0000-memory.dmp
memory/1652-2202-0x00000000000D0000-0x00000000000F9000-memory.dmp
memory/1688-2163-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2668-22-0x000000006F400000-0x000000006F9AB000-memory.dmp
memory/2668-20-0x0000000002660000-0x00000000026A0000-memory.dmp
memory/2668-19-0x0000000002660000-0x00000000026A0000-memory.dmp
memory/2668-18-0x000000006F400000-0x000000006F9AB000-memory.dmp
memory/2668-17-0x0000000002660000-0x00000000026A0000-memory.dmp
memory/2668-16-0x000000006F400000-0x000000006F9AB000-memory.dmp
memory/2924-64-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-82-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-48-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-50-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-46-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-56-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-54-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-52-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-58-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-60-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-62-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-36-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-66-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-68-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-70-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-72-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-74-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-76-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-78-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-80-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-88-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-86-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-84-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-44-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-2161-0x0000000074430000-0x0000000074B1E000-memory.dmp
memory/2924-38-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-42-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-40-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-34-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-32-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-30-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-28-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-26-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-25-0x0000000004EB0000-0x0000000004F18000-memory.dmp
memory/2924-24-0x0000000004EB0000-0x0000000004F1E000-memory.dmp
memory/2924-23-0x0000000004730000-0x0000000004790000-memory.dmp
memory/2924-21-0x00000000049C0000-0x0000000004A00000-memory.dmp
memory/2924-15-0x0000000074430000-0x0000000074B1E000-memory.dmp
memory/2924-2-0x00000000049C0000-0x0000000004A00000-memory.dmp
memory/2924-1-0x0000000074430000-0x0000000074B1E000-memory.dmp
memory/2924-0-0x0000000000CB0000-0x0000000000D1A000-memory.dmp
memory/2956-5-0x000000006F6B0000-0x000000006FC5B000-memory.dmp
memory/2956-6-0x000000006F6B0000-0x000000006FC5B000-memory.dmp
memory/2956-7-0x0000000002730000-0x0000000002770000-memory.dmp
memory/2956-8-0x0000000002730000-0x0000000002770000-memory.dmp
memory/2956-9-0x000000006F6B0000-0x000000006FC5B000-memory.dmp