Analysis
- max time kernel
94s - max time network
115s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
17/04/2024, 07:33
General
- Target f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe
- Size 1.0MB
- Sample240417-jd2clsgh76
- SHA256 38ddffbd4400361632904e174fd92126ec7bdac25111851e0439dcddda7f132f
Malware Config
Extracted
-
xloader
-
2.3
-
dfa8
-
rocketgoldcorp.com
-
bdsportslive.com
-
szldbxg.com
-
teavelersjournal.com
-
nilmiro.com
-
empporiocar.com
-
xishuophp.net
-
multigremiosmadrid.com
-
tucsonlot.com
-
fitnessketo.com
-
ourhomeimprovements.com
-
fletcher-windows.com
-
shab834.com
-
neggouyadla.com
-
helps-support.net
-
waterst.one
-
schoolforshapers.com
-
shubhshaktinidhi.com
-
vintatts.com
-
ykmmailer18.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
- Xloader payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f5496358b80bd0a6a027ef71c50babd2_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_sdl2r14d.4zb.ps1
memory/4284-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4284-17-0x0000000001190000-0x00000000014DA000-memory.dmp
memory/4324-8-0x0000000005380000-0x0000000005392000-memory.dmp
memory/4324-10-0x0000000005210000-0x0000000005220000-memory.dmp
memory/4324-5-0x0000000005210000-0x0000000005220000-memory.dmp
memory/4324-6-0x0000000004FA0000-0x0000000004FAA000-memory.dmp
memory/4324-7-0x0000000005280000-0x00000000052D6000-memory.dmp
memory/4324-0-0x00000000004E0000-0x00000000005EC000-memory.dmp
memory/4324-9-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4324-4-0x0000000005070000-0x0000000005102000-memory.dmp
memory/4324-11-0x00000000067B0000-0x0000000006826000-memory.dmp
memory/4324-12-0x0000000006820000-0x0000000006850000-memory.dmp
memory/4324-3-0x0000000005620000-0x0000000005BC4000-memory.dmp
memory/4324-15-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4324-2-0x0000000004FD0000-0x000000000506C000-memory.dmp
memory/4324-1-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4392-23-0x00000000055F0000-0x0000000005656000-memory.dmp
memory/4392-39-0x0000000070570000-0x00000000705BC000-memory.dmp
memory/4392-20-0x00000000025B0000-0x00000000025C0000-memory.dmp
memory/4392-21-0x0000000004FC0000-0x00000000055E8000-memory.dmp
memory/4392-22-0x0000000004EA0000-0x0000000004EC2000-memory.dmp
memory/4392-18-0x0000000074750000-0x0000000074F00000-memory.dmp
memory/4392-16-0x0000000002410000-0x0000000002446000-memory.dmp
memory/4392-24-0x0000000005710000-0x0000000005776000-memory.dmp
memory/4392-34-0x0000000005940000-0x0000000005C94000-memory.dmp
memory/4392-35-0x0000000005D40000-0x0000000005D5E000-memory.dmp
memory/4392-36-0x0000000005DE0000-0x0000000005E2C000-memory.dmp
memory/4392-37-0x000000007F9E0000-0x000000007F9F0000-memory.dmp
memory/4392-38-0x0000000006310000-0x0000000006342000-memory.dmp
memory/4392-19-0x00000000025B0000-0x00000000025C0000-memory.dmp
memory/4392-49-0x0000000006350000-0x000000000636E000-memory.dmp
memory/4392-50-0x00000000025B0000-0x00000000025C0000-memory.dmp
memory/4392-51-0x0000000006F90000-0x0000000007033000-memory.dmp
memory/4392-52-0x00000000076C0000-0x0000000007D3A000-memory.dmp
memory/4392-53-0x0000000007060000-0x000000000707A000-memory.dmp
memory/4392-54-0x00000000070E0000-0x00000000070EA000-memory.dmp
memory/4392-55-0x00000000072E0000-0x0000000007376000-memory.dmp
memory/4392-56-0x0000000007260000-0x0000000007271000-memory.dmp
memory/4392-57-0x0000000007290000-0x000000000729E000-memory.dmp
memory/4392-58-0x00000000072A0000-0x00000000072B4000-memory.dmp
memory/4392-59-0x00000000073A0000-0x00000000073BA000-memory.dmp
memory/4392-60-0x0000000007380000-0x0000000007388000-memory.dmp
memory/4392-63-0x0000000074750000-0x0000000074F00000-memory.dmp