Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 08:44

General

  • Target

    fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe

  • Size

    566KB

  • MD5

    fc5e7180f8df26c39560f18d7e4f17a3

  • SHA1

    9d8adf3384edea39294d970f87834ddf55896463

  • SHA256

    51861af4be587112d2827d71c2c2c3adddc9e7531aa4bf2850d205be3dc50113

  • SHA512

    fded849636c297663144d7bf7835064de4c26aa78df666765c686d286508e92a60f085bfc0781b46d98836a728b6b0d1970bfcd7c1acaad13939b9c5c64fff77

  • SSDEEP

    6144:XwnMNVAKl5Y6SZ70111uX5KNYGo0KyDsZuRc4+bLQg+83Me3ae+QzfE:XwCmKlpzuXCzXDUOr8LQg+83MEl+E

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

rca2

Decoy

bapzcosmetics.com

skillsgage.com

mingshiweiye.com

dcc-compliance.com

emprenbook.com

firn.site

haryanaricemil.com

fleetwoodfoods.com

jlnxhbkj.com

surajsanyal.com

jubakey.com

auroraunitedshippingco.com

propolis-surabaya.com

vasinvestments.com

breederschallenge.com

tafcoo.com

417motoringparts.com

livemis.com

drainassist.com

kristenguestart.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3408
    • C:\Users\Admin\AppData\Local\Temp\fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\fc5e7180f8df26c39560f18d7e4f17a3_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4340
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "nj" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4060
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "nj" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exe"
          4⤵
          • Adds Run key to start application
          PID:4816
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
          "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2036
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
        3⤵
          PID:4212

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
      Filesize

      42KB

      MD5

      9827ff3cdf4b83f9c86354606736ca9c

      SHA1

      e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723

      SHA256

      c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a

      SHA512

      8261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkjn.exe
      Filesize

      566KB

      MD5

      fc5e7180f8df26c39560f18d7e4f17a3

      SHA1

      9d8adf3384edea39294d970f87834ddf55896463

      SHA256

      51861af4be587112d2827d71c2c2c3adddc9e7531aa4bf2850d205be3dc50113

      SHA512

      fded849636c297663144d7bf7835064de4c26aa78df666765c686d286508e92a60f085bfc0781b46d98836a728b6b0d1970bfcd7c1acaad13939b9c5c64fff77

    • memory/2000-44-0x0000000000560000-0x00000000005B7000-memory.dmp
      Filesize

      348KB

    • memory/2000-43-0x0000000000560000-0x00000000005B7000-memory.dmp
      Filesize

      348KB

    • memory/2000-50-0x00000000026A0000-0x000000000272F000-memory.dmp
      Filesize

      572KB

    • memory/2000-48-0x0000000000850000-0x0000000000878000-memory.dmp
      Filesize

      160KB

    • memory/2000-46-0x0000000002870000-0x0000000002BBA000-memory.dmp
      Filesize

      3.3MB

    • memory/2000-45-0x0000000000850000-0x0000000000878000-memory.dmp
      Filesize

      160KB

    • memory/2036-34-0x0000000000400000-0x0000000000428000-memory.dmp
      Filesize

      160KB

    • memory/2036-41-0x0000000000430000-0x0000000000440000-memory.dmp
      Filesize

      64KB

    • memory/2036-40-0x0000000000400000-0x0000000000428000-memory.dmp
      Filesize

      160KB

    • memory/2036-38-0x00000000009D0000-0x0000000000D1A000-memory.dmp
      Filesize

      3.3MB

    • memory/3408-52-0x0000000008A10000-0x0000000008ACF000-memory.dmp
      Filesize

      764KB

    • memory/3408-42-0x0000000008880000-0x0000000008A0D000-memory.dmp
      Filesize

      1.6MB

    • memory/3408-53-0x0000000008A10000-0x0000000008ACF000-memory.dmp
      Filesize

      764KB

    • memory/3408-56-0x0000000008A10000-0x0000000008ACF000-memory.dmp
      Filesize

      764KB

    • memory/4340-9-0x00000000054D0000-0x00000000054E0000-memory.dmp
      Filesize

      64KB

    • memory/4340-5-0x00000000054D0000-0x00000000054E0000-memory.dmp
      Filesize

      64KB

    • memory/4340-1-0x0000000075060000-0x0000000075810000-memory.dmp
      Filesize

      7.7MB

    • memory/4340-2-0x00000000057C0000-0x0000000005D64000-memory.dmp
      Filesize

      5.6MB

    • memory/4340-3-0x0000000005210000-0x00000000052A2000-memory.dmp
      Filesize

      584KB

    • memory/4340-4-0x00000000052B0000-0x000000000534C000-memory.dmp
      Filesize

      624KB

    • memory/4340-6-0x0000000006900000-0x0000000006938000-memory.dmp
      Filesize

      224KB

    • memory/4340-7-0x00000000054D0000-0x00000000054E0000-memory.dmp
      Filesize

      64KB

    • memory/4340-8-0x0000000075060000-0x0000000075810000-memory.dmp
      Filesize

      7.7MB

    • memory/4340-0-0x0000000000740000-0x00000000007D4000-memory.dmp
      Filesize

      592KB

    • memory/4340-24-0x0000000075060000-0x0000000075810000-memory.dmp
      Filesize

      7.7MB

    • memory/4340-10-0x00000000054D0000-0x00000000054E0000-memory.dmp
      Filesize

      64KB

    • memory/4804-25-0x0000000075060000-0x0000000075810000-memory.dmp
      Filesize

      7.7MB

    • memory/4804-26-0x0000000005010000-0x0000000005020000-memory.dmp
      Filesize

      64KB

    • memory/4804-37-0x0000000075060000-0x0000000075810000-memory.dmp
      Filesize

      7.7MB

    • memory/4804-27-0x0000000005010000-0x0000000005020000-memory.dmp
      Filesize

      64KB

    • memory/4804-29-0x0000000005010000-0x0000000005020000-memory.dmp
      Filesize

      64KB

    • memory/4804-28-0x0000000075060000-0x0000000075810000-memory.dmp
      Filesize

      7.7MB

    • memory/4804-32-0x0000000006270000-0x0000000006276000-memory.dmp
      Filesize

      24KB

    • memory/4804-31-0x0000000002590000-0x00000000025A4000-memory.dmp
      Filesize

      80KB

    • memory/4804-30-0x0000000005010000-0x0000000005020000-memory.dmp
      Filesize

      64KB