Analysis
-
max time kernel
142s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 09:41
Static task
static1
Behavioral task
behavioral1
Sample
f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
f336298269351704e8a3f7a5f071c82d
-
SHA1
ee8ba4b276bfb69be97518c994d9536eebc76e53
-
SHA256
837d5ed2867ffbf6b718264ecc27e620ffd9d14b1a4d2255f56b04181713830f
-
SHA512
3c0bdfc2e2df3426300e1642124b10a818dea0f62691868f48b4f7b409587060f03ede4d050b0cc1ba2883ccbdb66eb310b55f42da21bd490493edf0be9728f8
-
SSDEEP
24576:4lUWIHraPRdOG2nGhYrntpfV7WV/Nm/y12NhmK:4RILaPnpg0qnbPyYl
Malware Config
Extracted
xloader
2.3
k8b5
sardamedicals.com
reelectkendavis4council.com
coreconsultation.com
fajarazhary.com
mybitearner.com
brightpet.info
voicewithchoice.com
bailbondscompany.xyz
7133333333.com
delights.info
gawlvegdr.icu
sdqhpm.com
we2savvyok.com
primallifeathlete.com
gdsinglecell.com
isokineticmachines.com
smartneckrelax.com
gardenvintage.com
hiphopvolume.com
medicapoint.com
crybebe.com
elevatedgameplay.com
armespublishing.com
pathsiteofficial.com
xn--e-2fa.com
besoxie.com
pro-montage.com
smartsmsfloan.net
gafinstallations.com
osk2279.com
sexcam-live-sex.net
supermomsd.com
villa-sardi.com
nkb-webmart.com
vaaccidentdoctorsnearme.net
sewcialdistancesewing.com
smodery.com
mimik33.com
employeepremiumassistance.com
chenqixuan.com
whyyousuckatgolfmovie.com
scholarshdesk.xyz
suenosenescena.com
ombaked.com
growingbargains.com
growbigelite.com
michalwroblewski.online
selfpublishingprojectmgmt.com
salir.info
lutherdanavan.com
caraccidentlawyernearme.net
portraitverse.com
secure-alerts901.info
reviewscanada.com
andreasaction.com
mblinks.net
regulationtoshop.com
borderless-farm.com
excitingdailyshop.com
pawandalmia.net
greatplainsjane.com
operacionapoyo.com
26gibraltardrive.com
getportlandjustice.com
chongzhi365.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4420-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exedescription pid process target process PID 1800 set thread context of 4420 1800 f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exepid process 4420 f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe 4420 f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exedescription pid process target process PID 1800 wrote to memory of 4420 1800 f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe PID 1800 wrote to memory of 4420 1800 f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe PID 1800 wrote to memory of 4420 1800 f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe PID 1800 wrote to memory of 4420 1800 f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe PID 1800 wrote to memory of 4420 1800 f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe PID 1800 wrote to memory of 4420 1800 f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f336298269351704e8a3f7a5f071c82d_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1800-8-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/1800-6-0x0000000005920000-0x000000000593C000-memory.dmpFilesize
112KB
-
memory/1800-2-0x0000000005950000-0x0000000005EF4000-memory.dmpFilesize
5.6MB
-
memory/1800-3-0x0000000005290000-0x0000000005322000-memory.dmpFilesize
584KB
-
memory/1800-0-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/1800-5-0x0000000005330000-0x000000000533A000-memory.dmpFilesize
40KB
-
memory/1800-1-0x00000000007B0000-0x00000000008EC000-memory.dmpFilesize
1.2MB
-
memory/1800-7-0x0000000007EE0000-0x0000000007F7C000-memory.dmpFilesize
624KB
-
memory/1800-4-0x0000000005470000-0x0000000005480000-memory.dmpFilesize
64KB
-
memory/1800-9-0x0000000005470000-0x0000000005480000-memory.dmpFilesize
64KB
-
memory/1800-10-0x00000000083B0000-0x0000000008438000-memory.dmpFilesize
544KB
-
memory/1800-11-0x000000000AB10000-0x000000000AB62000-memory.dmpFilesize
328KB
-
memory/1800-15-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/4420-14-0x00000000018D0000-0x0000000001C1A000-memory.dmpFilesize
3.3MB
-
memory/4420-12-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4420-16-0x00000000018D0000-0x0000000001C1A000-memory.dmpFilesize
3.3MB