Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 07:33
Static task
static1
Behavioral task
behavioral1
Sample
f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
f5496358b80bd0a6a027ef71c50babd2
-
SHA1
576d34b2d11eb03ca3cab8b225a205143047bf8d
-
SHA256
38ddffbd4400361632904e174fd92126ec7bdac25111851e0439dcddda7f132f
-
SHA512
c60f138e173f3ce40a6020491bee98429aa8da0d13cafac6153312047816be160a48ec9e309698cc6a369f84bb4a3e6e2468b80d7daf1bd16bda5a1fcb74ccec
-
SSDEEP
24576:QUPvu9ZO5/d3NaK64fKsE5XyyjKR4nIiypS:QUPvyaaK64A5iyeR4I
Malware Config
Extracted
xloader
2.3
dfa8
rocketgoldcorp.com
bdsportslive.com
szldbxg.com
teavelersjournal.com
nilmiro.com
empporiocar.com
xishuophp.net
multigremiosmadrid.com
tucsonlot.com
fitnessketo.com
ourhomeimprovements.com
fletcher-windows.com
shab834.com
neggouyadla.com
helps-support.net
waterst.one
schoolforshapers.com
shubhshaktinidhi.com
vintatts.com
ykmmailer18.com
bellsma.com
shakibeautybrand.com
dhakasomoy.com
bentubuo.com
yourdoingamazingsweetie.com
hobiarwana.com
coguxama.com
tsakonianarchives.directory
fleurdelys-vungtau.com
quiqmediatools.com
easyshelfet.com
platesteam.net
learntechterms.com
twistedcolorpaintingpros.com
brookspathway.com
overblijfplanner.com
hikingisourministry.com
arthurgphelps.com
ddtv15.com
4jinbo.com
bridgendmunicipalbowlsclub.com
jojosdrop.com
helanmtmbox.com
wallet-tx-blochcaln.info
tymcallistersales.com
boomslzp.com
hnhengban.com
westpalmbeach.digital
archivenepal.com
pasabalikdoner.xyz
wxdjdz.com
hamptonshammock.com
naturalfixproject.com
gfrin.com
mmxxcollective.com
kilconconcreting.com
racevc.com
evocutnutritionstore.com
londoncityroyals.com
greatcoral.com
betshop.club
44idc.net
austincitylegacy.net
makeamericagreatagain2021.com
valorantpointsstore.com
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/2220-3-0x0000000000250000-0x0000000000262000-memory.dmp CustAttr -
Xloader payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2620-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2700-18-0x00000000026E0000-0x0000000002720000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exedescription pid process target process PID 2220 set thread context of 2620 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exepowershell.exepid process 2620 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe 2700 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2700 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exedescription pid process target process PID 2220 wrote to memory of 2700 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe powershell.exe PID 2220 wrote to memory of 2700 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe powershell.exe PID 2220 wrote to memory of 2700 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe powershell.exe PID 2220 wrote to memory of 2700 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe powershell.exe PID 2220 wrote to memory of 2620 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe PID 2220 wrote to memory of 2620 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe PID 2220 wrote to memory of 2620 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe PID 2220 wrote to memory of 2620 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe PID 2220 wrote to memory of 2620 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe PID 2220 wrote to memory of 2620 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe PID 2220 wrote to memory of 2620 2220 f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2220-0-0x0000000000AF0000-0x0000000000BFC000-memory.dmpFilesize
1.0MB
-
memory/2220-1-0x0000000074A80000-0x000000007516E000-memory.dmpFilesize
6.9MB
-
memory/2220-2-0x0000000005010000-0x0000000005050000-memory.dmpFilesize
256KB
-
memory/2220-3-0x0000000000250000-0x0000000000262000-memory.dmpFilesize
72KB
-
memory/2220-4-0x0000000074A80000-0x000000007516E000-memory.dmpFilesize
6.9MB
-
memory/2220-5-0x0000000005010000-0x0000000005050000-memory.dmpFilesize
256KB
-
memory/2220-6-0x0000000005050000-0x00000000050C6000-memory.dmpFilesize
472KB
-
memory/2220-7-0x0000000002190000-0x00000000021C0000-memory.dmpFilesize
192KB
-
memory/2220-13-0x0000000074A80000-0x000000007516E000-memory.dmpFilesize
6.9MB
-
memory/2620-8-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2620-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2620-12-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2620-14-0x0000000000C00000-0x0000000000F03000-memory.dmpFilesize
3.0MB
-
memory/2620-9-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2700-17-0x0000000074AD0000-0x000000007507B000-memory.dmpFilesize
5.7MB
-
memory/2700-18-0x00000000026E0000-0x0000000002720000-memory.dmpFilesize
256KB
-
memory/2700-19-0x0000000074AD0000-0x000000007507B000-memory.dmpFilesize
5.7MB
-
memory/2700-20-0x0000000074AD0000-0x000000007507B000-memory.dmpFilesize
5.7MB
-
memory/2700-21-0x00000000026E0000-0x0000000002720000-memory.dmpFilesize
256KB
-
memory/2700-22-0x0000000074AD0000-0x000000007507B000-memory.dmpFilesize
5.7MB