Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 07:26
Static task
static1
Behavioral task
behavioral1
Sample
74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe
-
Size
408KB
-
MD5
74bd3fc0782c84d45e5659a378f9dc01
-
SHA1
e905675d92d1ee0d278796af59827b1231cc9d34
-
SHA256
bffc9c0c74952c439ca980be37a1f1e21c182b13c992f1a345a541413bfea91a
-
SHA512
0da4491c4558970de3f13a85769d73354b2b369031fd3bfee2c8d3a393c814a005f6f2a3e32edf4d5c563dfaf0b3fdb1c49006ec51c2bd673bb814517dba7e80
-
SSDEEP
6144:LHAgbCa8sGQTpS1KzolRLNYXkw7W1ZA4s9m8HTVZ:LHX8kT8KznXkBskUTVZ
Malware Config
Extracted
xloader
2.1
u4xn
yanghl.com
decorvea.online
xn--fjq92bw28b1tloj5a39d42h.com
yumler.info
laketravisautosales.net
zjnrgx.info
harrimanpm.com
dell-yh.com
eze.fitness
pritpritzoom.com
hackgarage.com
mydomterry.net
castrotom.com
coffeecosplay.com
wsfg-hk.com
crystalbeachstudio.com
bestofreadbook.win
sutasz.info
yunfengyue.com
h11011.com
hfcwf.com
hate.ltd
ensembleharmonie.com
reikimaestro.com
ipz-127.com
totalunch.com
sn-iz.com
sanlorenzosuites.net
androidhunts.com
ci3tmsu.top
naciparaemprender.com
power-up-premium.site
news3105.pictures
netcone.net
ferimen.com
coffeeklat.com
vrtrainsimulator.com
jialingdi.net
cloudsupport-service.info
menshealthreport.net
my-agroparts.com
hitoketa-m.net
fer666.com
a36990.com
jeromesglobal.com
adimaio.com
carbapenem-resistant-option.com
samlinegroupuk.com
rokenstudio.com
koreayu61.com
qiyefanhe.com
ilovedelilah.com
yubeibaby.com
shopvoyeu.com
smilesandblossoms.com
dqicwa.info
jedichain.com
aquaterm.online
kabonyhandmade.com
agmtraders.com
musicfashionmust.com
dotrucksmax.live
getreadyherenow4.info
thequeenbeeteam.net
mage-cart.info
Signatures
-
Xloader payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1196-48-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/1196-56-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/2560-61-0x0000000000370000-0x0000000000398000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
sogm.exeAddInProcess32.exepid process 4132 sogm.exe 1196 AddInProcess32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msufr.exe = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\sogm.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
sogm.exeAddInProcess32.exemsiexec.exedescription pid process target process PID 4132 set thread context of 1196 4132 sogm.exe AddInProcess32.exe PID 1196 set thread context of 3300 1196 AddInProcess32.exe Explorer.EXE PID 2560 set thread context of 3300 2560 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exesogm.exeAddInProcess32.exemsiexec.exepid process 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe 4132 sogm.exe 4132 sogm.exe 4132 sogm.exe 1196 AddInProcess32.exe 1196 AddInProcess32.exe 1196 AddInProcess32.exe 1196 AddInProcess32.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe 2560 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
AddInProcess32.exemsiexec.exepid process 1196 AddInProcess32.exe 1196 AddInProcess32.exe 1196 AddInProcess32.exe 2560 msiexec.exe 2560 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exesogm.exeAddInProcess32.exemsiexec.exedescription pid process Token: SeDebugPrivilege 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe Token: SeDebugPrivilege 4132 sogm.exe Token: SeDebugPrivilege 1196 AddInProcess32.exe Token: SeDebugPrivilege 2560 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.execmd.exesogm.exeExplorer.EXEmsiexec.exedescription pid process target process PID 4728 wrote to memory of 3768 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe cmd.exe PID 4728 wrote to memory of 3768 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe cmd.exe PID 4728 wrote to memory of 3768 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe cmd.exe PID 3768 wrote to memory of 4348 3768 cmd.exe reg.exe PID 3768 wrote to memory of 4348 3768 cmd.exe reg.exe PID 3768 wrote to memory of 4348 3768 cmd.exe reg.exe PID 4728 wrote to memory of 4132 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe sogm.exe PID 4728 wrote to memory of 4132 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe sogm.exe PID 4728 wrote to memory of 4132 4728 74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe sogm.exe PID 4132 wrote to memory of 1196 4132 sogm.exe AddInProcess32.exe PID 4132 wrote to memory of 1196 4132 sogm.exe AddInProcess32.exe PID 4132 wrote to memory of 1196 4132 sogm.exe AddInProcess32.exe PID 4132 wrote to memory of 1196 4132 sogm.exe AddInProcess32.exe PID 4132 wrote to memory of 1196 4132 sogm.exe AddInProcess32.exe PID 4132 wrote to memory of 1196 4132 sogm.exe AddInProcess32.exe PID 3300 wrote to memory of 2560 3300 Explorer.EXE msiexec.exe PID 3300 wrote to memory of 2560 3300 Explorer.EXE msiexec.exe PID 3300 wrote to memory of 2560 3300 Explorer.EXE msiexec.exe PID 2560 wrote to memory of 3452 2560 msiexec.exe cmd.exe PID 2560 wrote to memory of 3452 2560 msiexec.exe cmd.exe PID 2560 wrote to memory of 3452 2560 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\74bd3fc0782c84d45e5659a378f9dc01_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v msufr.exe /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\sogm.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v msufr.exe /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\sogm.exe"4⤵
- Adds Run key to start application
-
C:\Users\Admin\sogm.exe"C:\Users\Admin\sogm.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\sogm.exeFilesize
408KB
MD574bd3fc0782c84d45e5659a378f9dc01
SHA1e905675d92d1ee0d278796af59827b1231cc9d34
SHA256bffc9c0c74952c439ca980be37a1f1e21c182b13c992f1a345a541413bfea91a
SHA5120da4491c4558970de3f13a85769d73354b2b369031fd3bfee2c8d3a393c814a005f6f2a3e32edf4d5c563dfaf0b3fdb1c49006ec51c2bd673bb814517dba7e80
-
memory/1196-56-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1196-53-0x0000000001530000-0x000000000187A000-memory.dmpFilesize
3.3MB
-
memory/1196-48-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2560-61-0x0000000000370000-0x0000000000398000-memory.dmpFilesize
160KB
-
memory/2560-59-0x0000000000120000-0x0000000000132000-memory.dmpFilesize
72KB
-
memory/2560-57-0x0000000000120000-0x0000000000132000-memory.dmpFilesize
72KB
-
memory/2560-55-0x0000000000120000-0x0000000000132000-memory.dmpFilesize
72KB
-
memory/4132-41-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4132-45-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4132-52-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4132-50-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4132-43-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4132-46-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4728-7-0x0000000005620000-0x000000000562A000-memory.dmpFilesize
40KB
-
memory/4728-44-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4728-8-0x00000000056D0000-0x0000000005762000-memory.dmpFilesize
584KB
-
memory/4728-12-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4728-0-0x0000000074ABE000-0x0000000074ABF000-memory.dmpFilesize
4KB
-
memory/4728-9-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4728-6-0x0000000005B90000-0x0000000006134000-memory.dmpFilesize
5.6MB
-
memory/4728-5-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4728-4-0x0000000074ABE000-0x0000000074ABF000-memory.dmpFilesize
4KB
-
memory/4728-3-0x0000000004CB0000-0x0000000004CCC000-memory.dmpFilesize
112KB
-
memory/4728-2-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4728-1-0x0000000000390000-0x00000000003FC000-memory.dmpFilesize
432KB