Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 08:44
Static task
static1
Behavioral task
behavioral1
Sample
fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe
-
Size
566KB
-
MD5
fc5e7180f8df26c39560f18d7e4f17a3
-
SHA1
9d8adf3384edea39294d970f87834ddf55896463
-
SHA256
51861af4be587112d2827d71c2c2c3adddc9e7531aa4bf2850d205be3dc50113
-
SHA512
fded849636c297663144d7bf7835064de4c26aa78df666765c686d286508e92a60f085bfc0781b46d98836a728b6b0d1970bfcd7c1acaad13939b9c5c64fff77
-
SSDEEP
6144:XwnMNVAKl5Y6SZ70111uX5KNYGo0KyDsZuRc4+bLQg+83Me3ae+QzfE:XwCmKlpzuXCzXDUOr8LQg+83MEl+E
Malware Config
Extracted
xloader
2.3
rca2
bapzcosmetics.com
skillsgage.com
mingshiweiye.com
dcc-compliance.com
emprenbook.com
firn.site
haryanaricemil.com
fleetwoodfoods.com
jlnxhbkj.com
surajsanyal.com
jubakey.com
auroraunitedshippingco.com
propolis-surabaya.com
vasinvestments.com
breederschallenge.com
tafcoo.com
417motoringparts.com
livemis.com
drainassist.com
kristenguestart.com
archangelhelicopters.com
theequitablebrands.com
ftbselect.com
rubberaspectroofing.co.uk
avonwear.com
bambourbon.com
bulukx.com
stocksuncovered.com
unazampanelcuore.com
fuckedupeverafter.com
laserawayspa.com
productosmigranjero.com
luxr-dubai.com
spiffyy.com
aldewanih1.com
representacionesiglesias.com
priceemall.com
smsinner.com
krakenupenterprises.com
sillysnarkysweet.com
calwestfinancing.com
thechoppingboard.net
nqpvyx.com
frankworks.art
digitalfilmdigest.com
duogong.net
ux300e.com
rockin-readers.com
dgjingqie.com
class-c-motorhomes.com
lendnehru.com
woeserey.club
habatomic.com
qlcdjsf.com
hotelconcepciobynobis.com
pmpmn.com
integralstatesproject.com
barbrareneebrighenti.com
siscomunicadocef2020.com
hulin.website
usaclisurvival.com
honeybee-benefits.com
150s1300e.com
sentenceswesay.com
zyn.info
Signatures
-
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2036-34-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/2036-40-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/2000-45-0x0000000000850000-0x0000000000878000-memory.dmp xloader behavioral2/memory/2000-48-0x0000000000850000-0x0000000000878000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe -
Drops startup file 2 IoCs
Processes:
fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exe fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exe fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
pkjn.exeAddInProcess32.exepid process 4804 pkjn.exe 2036 AddInProcess32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nj = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\pkjn.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
pkjn.exeAddInProcess32.exemsdt.exedescription pid process target process PID 4804 set thread context of 2036 4804 pkjn.exe AddInProcess32.exe PID 2036 set thread context of 3408 2036 AddInProcess32.exe Explorer.EXE PID 2000 set thread context of 3408 2000 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exepkjn.exeAddInProcess32.exemsdt.exepid process 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe 4804 pkjn.exe 4804 pkjn.exe 4804 pkjn.exe 2036 AddInProcess32.exe 2036 AddInProcess32.exe 2036 AddInProcess32.exe 2036 AddInProcess32.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe 2000 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
AddInProcess32.exemsdt.exepid process 2036 AddInProcess32.exe 2036 AddInProcess32.exe 2036 AddInProcess32.exe 2000 msdt.exe 2000 msdt.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exepkjn.exeAddInProcess32.exeExplorer.EXEmsdt.exedescription pid process Token: SeDebugPrivilege 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe Token: SeDebugPrivilege 4804 pkjn.exe Token: SeDebugPrivilege 2036 AddInProcess32.exe Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE Token: SeDebugPrivilege 2000 msdt.exe Token: SeShutdownPrivilege 3408 Explorer.EXE Token: SeCreatePagefilePrivilege 3408 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.execmd.exepkjn.exeExplorer.EXEmsdt.exedescription pid process target process PID 4340 wrote to memory of 4060 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe cmd.exe PID 4340 wrote to memory of 4060 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe cmd.exe PID 4340 wrote to memory of 4060 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe cmd.exe PID 4060 wrote to memory of 4816 4060 cmd.exe reg.exe PID 4060 wrote to memory of 4816 4060 cmd.exe reg.exe PID 4060 wrote to memory of 4816 4060 cmd.exe reg.exe PID 4340 wrote to memory of 4804 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe pkjn.exe PID 4340 wrote to memory of 4804 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe pkjn.exe PID 4340 wrote to memory of 4804 4340 fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe pkjn.exe PID 4804 wrote to memory of 2036 4804 pkjn.exe AddInProcess32.exe PID 4804 wrote to memory of 2036 4804 pkjn.exe AddInProcess32.exe PID 4804 wrote to memory of 2036 4804 pkjn.exe AddInProcess32.exe PID 4804 wrote to memory of 2036 4804 pkjn.exe AddInProcess32.exe PID 4804 wrote to memory of 2036 4804 pkjn.exe AddInProcess32.exe PID 4804 wrote to memory of 2036 4804 pkjn.exe AddInProcess32.exe PID 3408 wrote to memory of 2000 3408 Explorer.EXE msdt.exe PID 3408 wrote to memory of 2000 3408 Explorer.EXE msdt.exe PID 3408 wrote to memory of 2000 3408 Explorer.EXE msdt.exe PID 2000 wrote to memory of 4212 2000 msdt.exe cmd.exe PID 2000 wrote to memory of 4212 2000 msdt.exe cmd.exe PID 2000 wrote to memory of 4212 2000 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "nj" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "nj" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exe"4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exeFilesize
566KB
MD5fc5e7180f8df26c39560f18d7e4f17a3
SHA19d8adf3384edea39294d970f87834ddf55896463
SHA25651861af4be587112d2827d71c2c2c3adddc9e7531aa4bf2850d205be3dc50113
SHA512fded849636c297663144d7bf7835064de4c26aa78df666765c686d286508e92a60f085bfc0781b46d98836a728b6b0d1970bfcd7c1acaad13939b9c5c64fff77
-
memory/2000-44-0x0000000000560000-0x00000000005B7000-memory.dmpFilesize
348KB
-
memory/2000-43-0x0000000000560000-0x00000000005B7000-memory.dmpFilesize
348KB
-
memory/2000-50-0x00000000026A0000-0x000000000272F000-memory.dmpFilesize
572KB
-
memory/2000-48-0x0000000000850000-0x0000000000878000-memory.dmpFilesize
160KB
-
memory/2000-46-0x0000000002870000-0x0000000002BBA000-memory.dmpFilesize
3.3MB
-
memory/2000-45-0x0000000000850000-0x0000000000878000-memory.dmpFilesize
160KB
-
memory/2036-34-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2036-41-0x0000000000430000-0x0000000000440000-memory.dmpFilesize
64KB
-
memory/2036-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2036-38-0x00000000009D0000-0x0000000000D1A000-memory.dmpFilesize
3.3MB
-
memory/3408-52-0x0000000008A10000-0x0000000008ACF000-memory.dmpFilesize
764KB
-
memory/3408-42-0x0000000008880000-0x0000000008A0D000-memory.dmpFilesize
1.6MB
-
memory/3408-53-0x0000000008A10000-0x0000000008ACF000-memory.dmpFilesize
764KB
-
memory/3408-56-0x0000000008A10000-0x0000000008ACF000-memory.dmpFilesize
764KB
-
memory/4340-9-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/4340-5-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/4340-1-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/4340-2-0x00000000057C0000-0x0000000005D64000-memory.dmpFilesize
5.6MB
-
memory/4340-3-0x0000000005210000-0x00000000052A2000-memory.dmpFilesize
584KB
-
memory/4340-4-0x00000000052B0000-0x000000000534C000-memory.dmpFilesize
624KB
-
memory/4340-6-0x0000000006900000-0x0000000006938000-memory.dmpFilesize
224KB
-
memory/4340-7-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/4340-8-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/4340-0-0x0000000000740000-0x00000000007D4000-memory.dmpFilesize
592KB
-
memory/4340-24-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/4340-10-0x00000000054D0000-0x00000000054E0000-memory.dmpFilesize
64KB
-
memory/4804-25-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/4804-26-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/4804-37-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/4804-27-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/4804-29-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/4804-28-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/4804-32-0x0000000006270000-0x0000000006276000-memory.dmpFilesize
24KB
-
memory/4804-31-0x0000000002590000-0x00000000025A4000-memory.dmpFilesize
80KB
-
memory/4804-30-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB