Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 16:32
Static task
static1
Behavioral task
behavioral1
Sample
f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe
-
Size
229KB
-
MD5
f3df2367a79e7f135a7ddaefb423ae40
-
SHA1
a08be77c9e91a124e251155643086b3a91f0364c
-
SHA256
0f09b5a5ad2bf792ed543e2b170d969e40591157ed92b5766c3cc3ab7deb2df1
-
SHA512
7fac3bf55ceecb2c6c81d65485098164de00f977415b349dc198c2ef9145792032b9a27302e2cc1c1c1e7d5d33c9dfeb38d6c530f6d26e5f6e2eb505b0f64244
-
SSDEEP
6144:r0FCoUQZijcU2cYM7bEp+CyMNtark1pDXPw56x3u:w7UH2cYM7c+C9ZbXPrk
Malware Config
Extracted
xloader
2.3
noi6
yow.today
rkdreamcreations.com
etheriumtech.com
stretchwrench.com
kiddiecruise.com
stickforward.com
videocineproduccion.com
roofinginamerica.com
amarillasnuevomexico.com
armfieldmillerripley.com
macyburn.club
lvbaoshan.com
shopshelponline.com
thebunnybrands.com
newsxplor.com
momunani.com
rebelnqueen.com
tusguitarras.com
nexab2b.com
e3office.express
restpostenboerse.com
empdx.net
treekium.com
kuyumcusigortasi.com
icufashionaccessories.com
olv.design
vraniqi-plast.com
metalate.com
salondelalocura.com
parivarthanarchitects.com
lovewithjanel.community
thelifeprotectgroup.com
tukangphoto.com
seguridadcusaem.com
europeisawesome.com
celinbag.com
e-basvuru-hizmetleri.com
myfojwinx.icu
wecamptee.com
weihang0769.com
onlinecolorization.com
vaccinocovid19.info
novastreaming.net
menuhaliving.com
gayderjoes.com
pantysniffershop.com
powerbie.com
naplesebike.com
chipinsideyourbrain.com
thegioicaytrongnha.com
downtowntallyretreat.com
latiaov.net
albanyfence.com
ttzya.com
jvillehatchery.com
shaonix.com
swaphomeloans.com
hotelsasian.com
truckcar.info
papocabecaepescoco.net
dekodizajn.com
bulukx.com
turbochargeyourwriting.com
lcscards-veilig.icu
offshoresrilanka.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2532-2-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exedescription pid process target process PID 2528 set thread context of 2532 2528 f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exepid process 2532 f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exepid process 2528 f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exedescription pid process target process PID 2528 wrote to memory of 2532 2528 f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe PID 2528 wrote to memory of 2532 2528 f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe PID 2528 wrote to memory of 2532 2528 f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe PID 2528 wrote to memory of 2532 2528 f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe PID 2528 wrote to memory of 2532 2528 f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3df2367a79e7f135a7ddaefb423ae40_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2528-0-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/2528-1-0x0000000000300000-0x0000000000302000-memory.dmpFilesize
8KB
-
memory/2532-2-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2532-5-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/2532-6-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB