Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 03:13
Static task
static1
Behavioral task
behavioral1
Sample
74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe
-
Size
408KB
-
MD5
74bd3fc0782c84d45e5659a378f9dc01
-
SHA1
e905675d92d1ee0d278796af59827b1231cc9d34
-
SHA256
bffc9c0c74952c439ca980be37a1f1e21c182b13c992f1a345a541413bfea91a
-
SHA512
0da4491c4558970de3f13a85769d73354b2b369031fd3bfee2c8d3a393c814a005f6f2a3e32edf4d5c563dfaf0b3fdb1c49006ec51c2bd673bb814517dba7e80
-
SSDEEP
6144:LHAgbCa8sGQTpS1KzolRLNYXkw7W1ZA4s9m8HTVZ:LHX8kT8KznXkBskUTVZ
Malware Config
Extracted
xloader
2.1
u4xn
yanghl.com
decorvea.online
xn--fjq92bw28b1tloj5a39d42h.com
yumler.info
laketravisautosales.net
zjnrgx.info
harrimanpm.com
dell-yh.com
eze.fitness
pritpritzoom.com
hackgarage.com
mydomterry.net
castrotom.com
coffeecosplay.com
wsfg-hk.com
crystalbeachstudio.com
bestofreadbook.win
sutasz.info
yunfengyue.com
h11011.com
hfcwf.com
hate.ltd
ensembleharmonie.com
reikimaestro.com
ipz-127.com
totalunch.com
sn-iz.com
sanlorenzosuites.net
androidhunts.com
ci3tmsu.top
naciparaemprender.com
power-up-premium.site
news3105.pictures
netcone.net
ferimen.com
coffeeklat.com
vrtrainsimulator.com
jialingdi.net
cloudsupport-service.info
menshealthreport.net
my-agroparts.com
hitoketa-m.net
fer666.com
a36990.com
jeromesglobal.com
adimaio.com
carbapenem-resistant-option.com
samlinegroupuk.com
rokenstudio.com
koreayu61.com
qiyefanhe.com
ilovedelilah.com
yubeibaby.com
shopvoyeu.com
smilesandblossoms.com
dqicwa.info
jedichain.com
aquaterm.online
kabonyhandmade.com
agmtraders.com
musicfashionmust.com
dotrucksmax.live
getreadyherenow4.info
thequeenbeeteam.net
mage-cart.info
Signatures
-
Xloader payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/948-26-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/948-29-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1456-32-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
sogm.exeAddInProcess32.exepid process 2132 sogm.exe 948 AddInProcess32.exe -
Loads dropped DLL 2 IoCs
Processes:
74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exesogm.exepid process 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe 2132 sogm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\msufr.exe = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\sogm.exe" reg.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
sogm.exeAddInProcess32.execolorcpl.exedescription pid process target process PID 2132 set thread context of 948 2132 sogm.exe AddInProcess32.exe PID 948 set thread context of 1380 948 AddInProcess32.exe Explorer.EXE PID 948 set thread context of 1380 948 AddInProcess32.exe Explorer.EXE PID 1456 set thread context of 1380 1456 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exesogm.exeAddInProcess32.execolorcpl.exepid process 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe 2132 sogm.exe 2132 sogm.exe 2132 sogm.exe 948 AddInProcess32.exe 948 AddInProcess32.exe 948 AddInProcess32.exe 1456 colorcpl.exe 1456 colorcpl.exe 1456 colorcpl.exe 1456 colorcpl.exe 1456 colorcpl.exe 1456 colorcpl.exe 1456 colorcpl.exe 1456 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
AddInProcess32.execolorcpl.exepid process 948 AddInProcess32.exe 948 AddInProcess32.exe 948 AddInProcess32.exe 948 AddInProcess32.exe 1456 colorcpl.exe 1456 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exesogm.exeAddInProcess32.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe Token: SeDebugPrivilege 2132 sogm.exe Token: SeDebugPrivilege 948 AddInProcess32.exe Token: SeDebugPrivilege 1456 colorcpl.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.execmd.exesogm.exeAddInProcess32.execolorcpl.exedescription pid process target process PID 1752 wrote to memory of 2624 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe cmd.exe PID 1752 wrote to memory of 2624 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe cmd.exe PID 1752 wrote to memory of 2624 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe cmd.exe PID 1752 wrote to memory of 2624 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe cmd.exe PID 2624 wrote to memory of 2848 2624 cmd.exe reg.exe PID 2624 wrote to memory of 2848 2624 cmd.exe reg.exe PID 2624 wrote to memory of 2848 2624 cmd.exe reg.exe PID 2624 wrote to memory of 2848 2624 cmd.exe reg.exe PID 1752 wrote to memory of 2132 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe sogm.exe PID 1752 wrote to memory of 2132 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe sogm.exe PID 1752 wrote to memory of 2132 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe sogm.exe PID 1752 wrote to memory of 2132 1752 74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe sogm.exe PID 2132 wrote to memory of 948 2132 sogm.exe AddInProcess32.exe PID 2132 wrote to memory of 948 2132 sogm.exe AddInProcess32.exe PID 2132 wrote to memory of 948 2132 sogm.exe AddInProcess32.exe PID 2132 wrote to memory of 948 2132 sogm.exe AddInProcess32.exe PID 2132 wrote to memory of 948 2132 sogm.exe AddInProcess32.exe PID 2132 wrote to memory of 948 2132 sogm.exe AddInProcess32.exe PID 2132 wrote to memory of 948 2132 sogm.exe AddInProcess32.exe PID 948 wrote to memory of 1456 948 AddInProcess32.exe colorcpl.exe PID 948 wrote to memory of 1456 948 AddInProcess32.exe colorcpl.exe PID 948 wrote to memory of 1456 948 AddInProcess32.exe colorcpl.exe PID 948 wrote to memory of 1456 948 AddInProcess32.exe colorcpl.exe PID 1456 wrote to memory of 2336 1456 colorcpl.exe cmd.exe PID 1456 wrote to memory of 2336 1456 colorcpl.exe cmd.exe PID 1456 wrote to memory of 2336 1456 colorcpl.exe cmd.exe PID 1456 wrote to memory of 2336 1456 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\74bd3fc0782c84d45e5659a378f9dc01JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v msufr.exe /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\sogm.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v msufr.exe /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\sogm.exe"4⤵
- Adds Run key to start application
-
C:\Users\Admin\sogm.exe"C:\Users\Admin\sogm.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"6⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\sogm.exeFilesize
408KB
MD574bd3fc0782c84d45e5659a378f9dc01
SHA1e905675d92d1ee0d278796af59827b1231cc9d34
SHA256bffc9c0c74952c439ca980be37a1f1e21c182b13c992f1a345a541413bfea91a
SHA5120da4491c4558970de3f13a85769d73354b2b369031fd3bfee2c8d3a393c814a005f6f2a3e32edf4d5c563dfaf0b3fdb1c49006ec51c2bd673bb814517dba7e80
-
memory/948-29-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/948-26-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/948-21-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/948-23-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/948-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1380-33-0x0000000006C10000-0x0000000006D49000-memory.dmpFilesize
1.2MB
-
memory/1380-30-0x0000000007450000-0x00000000075B9000-memory.dmpFilesize
1.4MB
-
memory/1456-32-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/1456-31-0x0000000000850000-0x0000000000868000-memory.dmpFilesize
96KB
-
memory/1752-5-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/1752-18-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/1752-10-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/1752-7-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/1752-6-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/1752-0-0x0000000073F6E000-0x0000000073F6F000-memory.dmpFilesize
4KB
-
memory/1752-4-0x0000000073F6E000-0x0000000073F6F000-memory.dmpFilesize
4KB
-
memory/1752-3-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/1752-2-0x0000000000300000-0x000000000031C000-memory.dmpFilesize
112KB
-
memory/1752-1-0x0000000000B20000-0x0000000000B8C000-memory.dmpFilesize
432KB
-
memory/2132-17-0x0000000000CE0000-0x0000000000D4C000-memory.dmpFilesize
432KB