Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 12:15
Static task
static1
Behavioral task
behavioral1
Sample
ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe
-
Size
753KB
-
MD5
ff404b207167fe0cdeb456afcdc2ee4f
-
SHA1
b00ed24eb45f6c00d1ef005395e64c19096d2f49
-
SHA256
c6a52e264384313d760b81ec595d9845c2086aefc514d093c9b160e4753ffb2b
-
SHA512
dd8acc7352ff9455bc50b703a3e6126989caa4cbd030740d4de3e24895ac378f094dca2bdfda939715512bf6e683e84506ddf669f78ef801a0788764934e64f5
-
SSDEEP
12288:ghRg9H1m42Z/qka6DjQOCejIb+JG/yFfZbVzlzB0tP8ndKJuf7T4Zp3h:URgV1mTZ/La6qejIbMG/Ofj5zSP8nddo
Malware Config
Extracted
xloader
2.3
wufn
rsautoluxe.com
theroseofsharonsalon.com
singnema.com
nathanielwhite108.com
theforumonline.com
iqpt.info
joneshondaservice.com
fafene.com
solanohomebuyerclass.com
zwq.xyz
searchlakeconroehomes.com
briative.com
frystmor.city
systemofyouth.com
sctsmney.com
tv-safetrading.com
thesweetboy.com
occulusblu.com
pawsthemomentpetphotography.com
travelstipsguide.com
verifypurchase.online
333s998.com
amsmapped.com
mimortgageexpert.com
joshuatreeresearch.com
brasilupshop.com
support24h.site
recipesdunnright.com
feathertiara.net
intoxickiss.com
greenmommarket.com
prinothhusky.com
800pls.info
martabaroagency.com
neosinder.com
davidwarburg.com
chinanl168.com
organicdiscover.com
kingdomvets.com
thetravellingwitch.com
kyg-cpa.com
bigarius.com
collegevillepaareahomes.com
ashestore.site
rizqebooks.com
techwhose.com
peak-valleyadvertising.com
craftbychristians.com
laterlifelendingsupermarket.com
setadragon.com
pon.xyz
reshemporium.com
missk-hair.com
hk6628.com
rootmoover.com
thetew.com
mybodysaver.com
cuadorcoast.com
goteclift.com
solisdq.info
hsicclassactionsettlement.com
cummingsforum.com
talleresmulticar.com
qq4004.com
gaigoilaocai.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4664-12-0x0000000000400000-0x0000000000428000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exedescription pid process target process PID 3100 set thread context of 4664 3100 ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exepid process 4664 ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe 4664 ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exedescription pid process target process PID 3100 wrote to memory of 4664 3100 ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe PID 3100 wrote to memory of 4664 3100 ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe PID 3100 wrote to memory of 4664 3100 ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe PID 3100 wrote to memory of 4664 3100 ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe PID 3100 wrote to memory of 4664 3100 ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe PID 3100 wrote to memory of 4664 3100 ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff404b207167fe0cdeb456afcdc2ee4f_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3100-8-0x0000000074BD0000-0x0000000075380000-memory.dmpFilesize
7.7MB
-
memory/3100-6-0x0000000005950000-0x000000000595A000-memory.dmpFilesize
40KB
-
memory/3100-1-0x0000000074BD0000-0x0000000075380000-memory.dmpFilesize
7.7MB
-
memory/3100-3-0x0000000005990000-0x0000000005A22000-memory.dmpFilesize
584KB
-
memory/3100-0-0x0000000000EE0000-0x0000000000FA2000-memory.dmpFilesize
776KB
-
memory/3100-5-0x0000000005960000-0x0000000005970000-memory.dmpFilesize
64KB
-
memory/3100-2-0x0000000005F40000-0x00000000064E4000-memory.dmpFilesize
5.6MB
-
memory/3100-7-0x0000000006CF0000-0x0000000006D02000-memory.dmpFilesize
72KB
-
memory/3100-4-0x0000000005A30000-0x0000000005ACC000-memory.dmpFilesize
624KB
-
memory/3100-9-0x0000000005960000-0x0000000005970000-memory.dmpFilesize
64KB
-
memory/3100-10-0x00000000072E0000-0x0000000007380000-memory.dmpFilesize
640KB
-
memory/3100-11-0x00000000097D0000-0x0000000009800000-memory.dmpFilesize
192KB
-
memory/3100-14-0x0000000074BD0000-0x0000000075380000-memory.dmpFilesize
7.7MB
-
memory/4664-12-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4664-15-0x0000000001430000-0x000000000177A000-memory.dmpFilesize
3.3MB
-
memory/4664-16-0x0000000001430000-0x000000000177A000-memory.dmpFilesize
3.3MB