Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
02/10/2024, 23:51
General
- Target 0cfa2a654fcca2a9f12f034d643027d5_JaffaCakes118.exe
- Size 725KB
- Sample241002-3wjp3atdkn
- SHA256 e14a0391577635a7e1121a2ff8c81df2c7d2787015c83839665c469a24f9ce0f
Malware Config
Extracted
-
xloader
-
2.3
-
n8ba
-
thefitflect.com
-
anytourist.com
-
blggz.xyz
-
ascope.club
-
obyeboss.com
-
braun-mathematik.online
-
mtsnurulislamsby.com
-
jwpropertiestn.com
-
animalds.com
-
cunerier.com
-
sillysocklife.com
-
shopliyonamaaghin.net
-
theredcymbalsco.com
-
lostbikeproject.com
-
ryggoqlmga.club
-
realestatetriggers.com
-
luvlauricephotography.com
-
cheesehome.cloud
-
5fashionfix.net
-
wata-6-rwem.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 47 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cfa2a654fcca2a9f12f034d643027d5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0cfa2a654fcca2a9f12f034d643027d5_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dglKKF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D9A.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp6D9A.tmp
memory/2992-32-0x0000000000770000-0x0000000000799000-memory.dmp
memory/2992-31-0x0000000000FF0000-0x0000000000FFB000-memory.dmp
memory/2992-30-0x0000000000FF0000-0x0000000000FFB000-memory.dmp
memory/3324-28-0x0000000001670000-0x0000000001681000-memory.dmp
memory/3324-21-0x00000000011F0000-0x000000000153A000-memory.dmp
memory/3324-27-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3324-23-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3324-24-0x0000000001190000-0x00000000011A1000-memory.dmp
memory/3324-18-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3452-38-0x0000000008A40000-0x0000000008B85000-memory.dmp
memory/3452-36-0x0000000008A40000-0x0000000008B85000-memory.dmp
memory/3452-33-0x0000000002CF0000-0x0000000002DBB000-memory.dmp
memory/3452-29-0x0000000002CF0000-0x0000000002DBB000-memory.dmp
memory/3452-25-0x0000000002E70000-0x0000000002F78000-memory.dmp
memory/4972-11-0x0000000008A00000-0x0000000008AA0000-memory.dmp
memory/4972-9-0x000000007443E000-0x000000007443F000-memory.dmp
memory/4972-4-0x0000000005700000-0x0000000005792000-memory.dmp
memory/4972-12-0x000000000B170000-0x000000000B19E000-memory.dmp
memory/4972-5-0x00000000056C0000-0x00000000056CA000-memory.dmp
memory/4972-10-0x0000000074430000-0x0000000074BE0000-memory.dmp
memory/4972-0-0x000000007443E000-0x000000007443F000-memory.dmp
memory/4972-20-0x0000000074430000-0x0000000074BE0000-memory.dmp
memory/4972-3-0x0000000005C10000-0x00000000061B4000-memory.dmp
memory/4972-2-0x00000000055B0000-0x000000000564C000-memory.dmp
memory/4972-1-0x0000000000B90000-0x0000000000C4C000-memory.dmp
memory/4972-8-0x0000000008510000-0x0000000008526000-memory.dmp
memory/4972-7-0x00000000058F0000-0x0000000005946000-memory.dmp
memory/4972-6-0x0000000074430000-0x0000000074BE0000-memory.dmp