Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 06:50
Static task
static1
Behavioral task
behavioral1
Sample
f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe
-
Size
763KB
-
MD5
f9bded6d9401144a3485ddd295dc2b7e
-
SHA1
98e4b809cd6fba4205a92679825966bba7e868f1
-
SHA256
de0204a1139358642d9fb0ceb2a62b58fe7f89cf254509f83c636b9ee2aa25ce
-
SHA512
3347248054bf8eb3ba194f3485fb0518ed7c220a7adcca59767f546321503e2769c461e4fda26f5027f117c95ec31c31d6b6e15dd7a2e3e4b184b5897440a6ac
-
SSDEEP
12288:Jbk3u/m4SZ/r4wLhgw3HqtkYjstnVGD42WzwssJIWAyb2VviWsg1KL3s0Oz:59/mDZ/rkyCo8D41zDeiVv1KLcD
Malware Config
Extracted
xloader
2.3
qcir
bahucharoptical.com
mididis.net
neenaknowsrealestate.com
thenaughtywoodworker.com
blackbackedbusiness.com
softwaremapper.com
kot-lab.net
ceipsanjuanbautista.net
binewsmontgomery.com
truenorthhomeschooling.com
careerbookstore.online
lilycampbellbooks.com
mbhpoetry.com
dropserved.com
fgroupsrilanka.com
theearwitness.com
greenbaycommunitytheater.com
fullscopebackgrounds.com
qzi-iz.com
jilleolk.com
getcheckedeasy.com
uniswap-dexc.com
carolnorton.com
bainrix.com
baobaborganic.com
lunchis.xyz
portfolio-l.online
myatlevents.com
sunrise.blue
jansheathbar.com
knowitstime.com
pestcontrolserviceshamilton.com
kitclever.com
tbgsecurity.cloud
fixkurye.com
silvercomettrails.com
twitterts.com
whitleycommunityhub.com
newwebunity.com
ttkaiw.com
leprechaunlawnsandtrees.com
kurrent.plus
afitnessdiary.com
komasa-sushi.website
amxh8888.com
siemensdekadealer.com
schenkelfarm.com
chilicowboy.com
dubaibizclub.com
044874.com
kamujanganikutan.com
oberstdorf.taxi
zeinabhairextension.com
maelislopez.com
celebrityinksouthaustralia.com
florette-theagency.com
unbonproprietaire.com
arehn.info
garimaepl.com
37pluxl5t.xyz
southsudantribune.com
aurorasprayfoam.net
passionpieceshb.com
launchersmarket.com
xn--tasarmsepeti-54b.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2664-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exedescription pid process target process PID 2852 set thread context of 2664 2852 f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exepid process 2664 f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exedescription pid process target process PID 2852 wrote to memory of 2664 2852 f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe PID 2852 wrote to memory of 2664 2852 f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe PID 2852 wrote to memory of 2664 2852 f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe PID 2852 wrote to memory of 2664 2852 f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe PID 2852 wrote to memory of 2664 2852 f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe PID 2852 wrote to memory of 2664 2852 f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe PID 2852 wrote to memory of 2664 2852 f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2664-8-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2664-14-0x0000000000BC0000-0x0000000000EC3000-memory.dmpFilesize
3.0MB
-
memory/2664-12-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2664-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2664-9-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2852-3-0x0000000000970000-0x0000000000982000-memory.dmpFilesize
72KB
-
memory/2852-6-0x00000000051C0000-0x0000000005260000-memory.dmpFilesize
640KB
-
memory/2852-7-0x0000000004CA0000-0x0000000004CD0000-memory.dmpFilesize
192KB
-
memory/2852-5-0x0000000004D40000-0x0000000004D80000-memory.dmpFilesize
256KB
-
memory/2852-4-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB
-
memory/2852-0-0x0000000000AF0000-0x0000000000BB6000-memory.dmpFilesize
792KB
-
memory/2852-2-0x0000000004D40000-0x0000000004D80000-memory.dmpFilesize
256KB
-
memory/2852-13-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB
-
memory/2852-1-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB