Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2024 23:51

General

  • Target

    0cfa2a654fcca2a9f12f034d643027d5_JaffaCakes118.exe

  • Size

    725KB

  • MD5

    0cfa2a654fcca2a9f12f034d643027d5

  • SHA1

    0c78acaba049a37e7436b0df828057decc6e0378

  • SHA256

    e14a0391577635a7e1121a2ff8c81df2c7d2787015c83839665c469a24f9ce0f

  • SHA512

    6460bb422c3b7b20aef15b4fc1de38c1eabda7db4a9045eb1dca41c4e7bdb56a2c14ef97ce9a75d2829283cffae3c828d59a081a62093ab7de8f1b7a157f40c4

  • SSDEEP

    12288:2VJt2iNeHK7znunNexM5fUql0ZdVvjY+8AMMbb77G9LTUL5yo4XUSD3MvYV8cz1r:2Vz1b7tdTZUMnK/ZPD3aYXz1

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

n8ba

Decoy

thefitflect.com

anytourist.com

blggz.xyz

ascope.club

obyeboss.com

braun-mathematik.online

mtsnurulislamsby.com

jwpropertiestn.com

animalds.com

cunerier.com

sillysocklife.com

shopliyonamaaghin.net

theredcymbalsco.com

lostbikeproject.com

ryggoqlmga.club

realestatetriggers.com

luvlauricephotography.com

cheesehome.cloud

5fashionfix.net

wata-6-rwem.net

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\0cfa2a654fcca2a9f12f034d643027d5_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\0cfa2a654fcca2a9f12f034d643027d5_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:984
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dglKKF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB6A2.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1792
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2576
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpB6A2.tmp

    Filesize

    1KB

    MD5

    c7b1bfdbf13dd4db848244b1b1ff5add

    SHA1

    419676b56d8d80ef2726a6d813c0d68d2e6afd96

    SHA256

    99a029094959eaf151ddd689f315ea352bb58bdfbe2a56d775defd0990262a2b

    SHA512

    b4eaaa7e82a453d7cc002b6194844cb55739e7d239aeb7ca240c74088415de7c26a33c08cabc049cff99e5f0a6e0706083b3f013c7a1012c40b7d847bce9842a

  • memory/984-6-0x0000000007FB0000-0x0000000008050000-memory.dmp

    Filesize

    640KB

  • memory/984-1-0x0000000000E70000-0x0000000000F2C000-memory.dmp

    Filesize

    752KB

  • memory/984-3-0x00000000004E0000-0x00000000004F6000-memory.dmp

    Filesize

    88KB

  • memory/984-4-0x000000007471E000-0x000000007471F000-memory.dmp

    Filesize

    4KB

  • memory/984-5-0x0000000074710000-0x0000000074DFE000-memory.dmp

    Filesize

    6.9MB

  • memory/984-17-0x0000000074710000-0x0000000074DFE000-memory.dmp

    Filesize

    6.9MB

  • memory/984-7-0x0000000000A00000-0x0000000000A2E000-memory.dmp

    Filesize

    184KB

  • memory/984-2-0x0000000074710000-0x0000000074DFE000-memory.dmp

    Filesize

    6.9MB

  • memory/984-0-0x000000007471E000-0x000000007471F000-memory.dmp

    Filesize

    4KB

  • memory/1244-27-0x0000000004EF0000-0x0000000005011000-memory.dmp

    Filesize

    1.1MB

  • memory/1244-22-0x0000000004EF0000-0x0000000005011000-memory.dmp

    Filesize

    1.1MB

  • memory/2552-26-0x00000000000C0000-0x00000000000E9000-memory.dmp

    Filesize

    164KB

  • memory/2552-25-0x0000000000520000-0x0000000000528000-memory.dmp

    Filesize

    32KB

  • memory/2552-23-0x0000000000520000-0x0000000000528000-memory.dmp

    Filesize

    32KB

  • memory/2576-14-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2576-20-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2576-21-0x00000000005E0000-0x00000000005F1000-memory.dmp

    Filesize

    68KB

  • memory/2576-18-0x0000000000770000-0x0000000000A73000-memory.dmp

    Filesize

    3.0MB

  • memory/2576-15-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2576-16-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2576-13-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB