Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-04-2024 02:10
Static task
static1
Behavioral task
behavioral1
Sample
fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe
-
Size
939KB
-
MD5
fe2fc04068910b2e437f2dc9cd200ede
-
SHA1
25f9e68d137d9b3b708eaa0e46b8d897b5f725bf
-
SHA256
4685c8e4c8836d97c08ac60084f1ad2a12e0abed103c9a7048e3c36b40e8ed6d
-
SHA512
5dba5c5dcafcf87d9f4e59a2e1c9889ccbda8c537a1560249955ab5c70d9a1a13909d066987b755c49b0ce2af431a45c0f2dfd5c73638acd6b1c77b6d3647057
-
SSDEEP
24576:zkIW8ijyZU2YGaev1e0C40ui4ShmljIbnQrKboM:zkDZjAaet44S2IbnB0M
Malware Config
Extracted
xloader
2.3
uecu
ishtarhotel.com
woodstrends.icu
jalenowens.com
manno.expert
ssg1asia.com
telepathylaw.com
quickoprintnv.com
abrosnm3.com
lumberjackcatering.com
beachujamaica.com
thomasjeffersonbyrd.com
starryfinds.com
shelavish2.com
royalglamempirellc.com
deixandomeuemprego.com
alexgoestech.xyz
opticamn.com
fermanchevybrandon.com
milbodegas.info
adunarsrl.com
dataatlus.com
missabrams.com
beaconservicesuk.com
tvforpc.website
dipmarketingagency.com
milsontt.com
londonsashwindowsservices.com
feedmysheepdaily.com
firsttimephysics.com
hosefire.com
southdocknj.com
idfstool.com
drelip.com
decayette.com
awakenedgodsofbeauty.com
easttexasranch.com
risinglanka.com
meetingoffices.com
vase-composition.com
kupon.asia
alltimeselfstorage.com
gatorbrewcoffee.com
api-pay-agent.com
height-project.online
flbtyc638.com
psdmoravita.com
highbrowhairstudio.com
deepblueriver.com
yh22022.com
sts-100.com
michaelfmoore.com
alzheimers.computer
produtos-servicos.website
zyuyktlcu.icu
ezewasser.com
outstanding-palisade.com
saioura.com
core.run
allaboutlifeblog.com
foodolog.net
somerderm.com
scootrlv.com
ahjjbxg.com
gasworldchampionships.com
illoftapartments.com
Signatures
-
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2764-12-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2764-17-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2764-21-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1712-26-0x00000000000A0000-0x00000000000C8000-memory.dmp xloader behavioral1/memory/1712-28-0x00000000000A0000-0x00000000000C8000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exeRegSvcs.execontrol.exedescription pid process target process PID 2228 set thread context of 2764 2228 fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe RegSvcs.exe PID 2764 set thread context of 1212 2764 RegSvcs.exe Explorer.EXE PID 2764 set thread context of 1212 2764 RegSvcs.exe Explorer.EXE PID 1712 set thread context of 1212 1712 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
RegSvcs.execontrol.exepid process 2764 RegSvcs.exe 2764 RegSvcs.exe 2764 RegSvcs.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe 1712 control.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.execontrol.exepid process 2764 RegSvcs.exe 2764 RegSvcs.exe 2764 RegSvcs.exe 2764 RegSvcs.exe 1712 control.exe 1712 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.execontrol.exedescription pid process Token: SeDebugPrivilege 2764 RegSvcs.exe Token: SeDebugPrivilege 1712 control.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exeExplorer.EXEcontrol.exedescription pid process target process PID 2228 wrote to memory of 2764 2228 fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe RegSvcs.exe PID 2228 wrote to memory of 2764 2228 fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe RegSvcs.exe PID 2228 wrote to memory of 2764 2228 fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe RegSvcs.exe PID 2228 wrote to memory of 2764 2228 fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe RegSvcs.exe PID 2228 wrote to memory of 2764 2228 fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe RegSvcs.exe PID 2228 wrote to memory of 2764 2228 fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe RegSvcs.exe PID 2228 wrote to memory of 2764 2228 fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe RegSvcs.exe PID 2228 wrote to memory of 2764 2228 fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe RegSvcs.exe PID 2228 wrote to memory of 2764 2228 fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe RegSvcs.exe PID 2228 wrote to memory of 2764 2228 fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe RegSvcs.exe PID 1212 wrote to memory of 1712 1212 Explorer.EXE control.exe PID 1212 wrote to memory of 1712 1212 Explorer.EXE control.exe PID 1212 wrote to memory of 1712 1212 Explorer.EXE control.exe PID 1212 wrote to memory of 1712 1212 Explorer.EXE control.exe PID 1712 wrote to memory of 768 1712 control.exe cmd.exe PID 1712 wrote to memory of 768 1712 control.exe cmd.exe PID 1712 wrote to memory of 768 1712 control.exe cmd.exe PID 1712 wrote to memory of 768 1712 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe2fc04068910b2e437f2dc9cd200ede_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1212-16-0x0000000003A90000-0x0000000003B90000-memory.dmpFilesize
1024KB
-
memory/1212-33-0x0000000002DE0000-0x0000000002E9D000-memory.dmpFilesize
756KB
-
memory/1212-32-0x0000000006660000-0x00000000067C0000-memory.dmpFilesize
1.4MB
-
memory/1212-23-0x0000000002DE0000-0x0000000002E9D000-memory.dmpFilesize
756KB
-
memory/1212-19-0x0000000006660000-0x00000000067C0000-memory.dmpFilesize
1.4MB
-
memory/1712-25-0x0000000000050000-0x000000000006F000-memory.dmpFilesize
124KB
-
memory/1712-28-0x00000000000A0000-0x00000000000C8000-memory.dmpFilesize
160KB
-
memory/1712-24-0x0000000000050000-0x000000000006F000-memory.dmpFilesize
124KB
-
memory/1712-26-0x00000000000A0000-0x00000000000C8000-memory.dmpFilesize
160KB
-
memory/1712-27-0x0000000001EC0000-0x00000000021C3000-memory.dmpFilesize
3.0MB
-
memory/1712-30-0x0000000001D40000-0x0000000001DCF000-memory.dmpFilesize
572KB
-
memory/2228-2-0x0000000004D60000-0x0000000004DA0000-memory.dmpFilesize
256KB
-
memory/2228-13-0x0000000074460000-0x0000000074B4E000-memory.dmpFilesize
6.9MB
-
memory/2228-6-0x0000000005720000-0x00000000057BE000-memory.dmpFilesize
632KB
-
memory/2228-5-0x0000000004D60000-0x0000000004DA0000-memory.dmpFilesize
256KB
-
memory/2228-0-0x0000000000260000-0x0000000000350000-memory.dmpFilesize
960KB
-
memory/2228-1-0x0000000074460000-0x0000000074B4E000-memory.dmpFilesize
6.9MB
-
memory/2228-4-0x0000000074460000-0x0000000074B4E000-memory.dmpFilesize
6.9MB
-
memory/2228-7-0x0000000001F50000-0x0000000001F7E000-memory.dmpFilesize
184KB
-
memory/2228-3-0x00000000006A0000-0x00000000006B6000-memory.dmpFilesize
88KB
-
memory/2764-12-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2764-22-0x00000000001B0000-0x00000000001C0000-memory.dmpFilesize
64KB
-
memory/2764-21-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2764-17-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2764-18-0x0000000000170000-0x0000000000180000-memory.dmpFilesize
64KB
-
memory/2764-14-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB
-
memory/2764-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2764-9-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2764-8-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB