Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 22:04

General

  • Target

    fdbfac3db38e579f28f6a51e55e7b01b_JaffaCakes118.exe

  • Size

    831KB

  • MD5

    fdbfac3db38e579f28f6a51e55e7b01b

  • SHA1

    88e11b109d1f9e6e4be019561ab6429e4ad838ad

  • SHA256

    7854503f3fc57a985d64d1b24fe2517497f6ec23338156a25a77dc5c0e7c6e17

  • SHA512

    249af205b79510db4e10bcb3d8d0419af5a7005b6c66810e4d9221ba7bc44e600f1ed087d991a91b6eb70c85209e9770ad6051fe83b61a3a96f06ad58f4f352a

  • SSDEEP

    12288:Hbi3JClVEQxWpU/01Y2mVVZRDvlC2kZlxin119bua3lz:HbiiERpUM1Y2mhV3gAndbuK

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

n8ba

Decoy

thefitflect.com

anytourist.com

blggz.xyz

ascope.club

obyeboss.com

braun-mathematik.online

mtsnurulislamsby.com

jwpropertiestn.com

animalds.com

cunerier.com

sillysocklife.com

shopliyonamaaghin.net

theredcymbalsco.com

lostbikeproject.com

ryggoqlmga.club

realestatetriggers.com

luvlauricephotography.com

cheesehome.cloud

5fashionfix.net

wata-6-rwem.net

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Users\Admin\AppData\Local\Temp\fdbfac3db38e579f28f6a51e55e7b01b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\fdbfac3db38e579f28f6a51e55e7b01b_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3624
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bsWPlgF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpECE0.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:4336
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1448
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:752
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2220

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Execution

    Scheduled Task/Job

    1
    T1053

    Persistence

    Scheduled Task/Job

    1
    T1053

    Privilege Escalation

    Scheduled Task/Job

    1
    T1053

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpECE0.tmp
      Filesize

      1KB

      MD5

      f780856d853286b319f33dc29d97da1d

      SHA1

      4c0c2d5529b87c1a01517d811d56cc85fd214061

      SHA256

      8cdb1e146703009ac9e908da8893620cce33df2c240e9e3cc9dc2fa6f900251a

      SHA512

      a482e8a05121e236eb55fc91df67081fb83f875156d34d555d2b4e918c17171484a8975e06ff855d700c20d3f38083e2ef6fbd502e68cf5c365cbad8be3d7fc5

    • memory/752-33-0x0000000001200000-0x0000000001290000-memory.dmp
      Filesize

      576KB

    • memory/752-31-0x0000000000860000-0x0000000000889000-memory.dmp
      Filesize

      164KB

    • memory/752-30-0x0000000001300000-0x000000000164A000-memory.dmp
      Filesize

      3.3MB

    • memory/752-29-0x0000000000860000-0x0000000000889000-memory.dmp
      Filesize

      164KB

    • memory/752-28-0x00000000004B0000-0x00000000004BE000-memory.dmp
      Filesize

      56KB

    • memory/752-26-0x00000000004B0000-0x00000000004BE000-memory.dmp
      Filesize

      56KB

    • memory/1448-18-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1448-21-0x00000000016F0000-0x0000000001A3A000-memory.dmp
      Filesize

      3.3MB

    • memory/1448-23-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1448-24-0x00000000011C0000-0x00000000011D1000-memory.dmp
      Filesize

      68KB

    • memory/3448-40-0x0000000008B10000-0x0000000008C99000-memory.dmp
      Filesize

      1.5MB

    • memory/3448-37-0x0000000008B10000-0x0000000008C99000-memory.dmp
      Filesize

      1.5MB

    • memory/3448-36-0x0000000008B10000-0x0000000008C99000-memory.dmp
      Filesize

      1.5MB

    • memory/3448-25-0x0000000008680000-0x00000000087C2000-memory.dmp
      Filesize

      1.3MB

    • memory/3624-7-0x0000000005700000-0x0000000005756000-memory.dmp
      Filesize

      344KB

    • memory/3624-4-0x0000000005570000-0x0000000005602000-memory.dmp
      Filesize

      584KB

    • memory/3624-1-0x0000000075180000-0x0000000075930000-memory.dmp
      Filesize

      7.7MB

    • memory/3624-8-0x00000000057E0000-0x00000000057F8000-memory.dmp
      Filesize

      96KB

    • memory/3624-12-0x0000000009410000-0x0000000009446000-memory.dmp
      Filesize

      216KB

    • memory/3624-6-0x0000000005450000-0x000000000545A000-memory.dmp
      Filesize

      40KB

    • memory/3624-5-0x0000000002E60000-0x0000000002E70000-memory.dmp
      Filesize

      64KB

    • memory/3624-20-0x0000000075180000-0x0000000075930000-memory.dmp
      Filesize

      7.7MB

    • memory/3624-3-0x0000000005B20000-0x00000000060C4000-memory.dmp
      Filesize

      5.6MB

    • memory/3624-2-0x0000000005460000-0x00000000054FC000-memory.dmp
      Filesize

      624KB

    • memory/3624-0-0x00000000009B0000-0x0000000000A86000-memory.dmp
      Filesize

      856KB

    • memory/3624-11-0x0000000006AB0000-0x0000000006B56000-memory.dmp
      Filesize

      664KB

    • memory/3624-10-0x0000000002E60000-0x0000000002E70000-memory.dmp
      Filesize

      64KB

    • memory/3624-9-0x0000000075180000-0x0000000075930000-memory.dmp
      Filesize

      7.7MB