Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 15:37
Static task
static1
Behavioral task
behavioral1
Sample
095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exe
-
Size
345KB
-
MD5
095d3e149a73c5daa7da04428ee3d561
-
SHA1
a2bee1c142d50ef4f821e30eae5a1a30efa8f009
-
SHA256
a8fe6d7fa624e8e96f71d3ff6375a012b44b51f06179feb7cef8c33fd6d38570
-
SHA512
69912e46c134c99f03af4dbc9dd9dbd7da100e56c513d7be6f92d38a69eae2094c85aab239dff41d5a84dfe3e92dc730e0653f74e668e556d9c84d4ad677b650
-
SSDEEP
6144:vv0M3Nkx/86kMUoM4fonNsK1UQR24dkyc1QCPBvHgy8DPlJB7F9GzypL1yO42s2b:vcM3H6kM7gnRBR24yRPBPgy8DNFwe7ya
Malware Config
Extracted
xloader
2.3
m3de
ad-unity.com
republicans2032.com
blackculturewriters.com
wallnewphoto.com
etripideas.com
solarphlare.com
consultoranexo.com
hayasalon.com
pillowcasefactory.club
service-manbzcsexer.com
medicinerx.today
oliviarescigno.com
tomcruise.club
tetsim.com
atonalai.net
malcomsons.com
straitskids.com
luca-cci.com
pero.financial
wowbdshop.com
williammassimi.com
856379738.xyz
freshsifish.com
instinctbands.com
immignet.com
contex3.info
rawvegangoods.com
sn1008.com
lyo.xyz
hopefulsoil.com
igxwdxggfg8d2.net
gp240.com
martymohr.com
divineseo.com
nelvine.com
cryptotshirtshop.com
linglingproperty.com
tvdeu.com
massiv.agency
helforddepositaryservices.com
moneys365.online
stagepins.com
techinspect.online
playrajshreelucky.com
wingmonsters.com
cleveland.sucks
karmikclothing.com
tuandphillip.com
gywj2020.com
lapicy.com
schwarzwald-erleben.net
citestaccnt1597754245.com
perfectretreatswa.com
canadianmusicindustrycd.com
muhunt.net
arcax.info
avpwine.com
blazingsandals.com
rcdfashion.info
darling-date.com
nashrahsecretz.com
houstongundealer.com
parislovearts.com
bagibaso.com
sunsfactory.net
Signatures
-
Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
Processes:
resource yara_rule behavioral2/memory/3896-2-0x0000000000EE0000-0x0000000000F22000-memory.dmp Core1 -
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3896-2-0x0000000000EE0000-0x0000000000F22000-memory.dmp xloader behavioral2/memory/3896-3-0x00000000011F0000-0x0000000001218000-memory.dmp xloader behavioral2/memory/952-13-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/4040-18-0x00000000001D0000-0x00000000001F8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exesvchost.exesvchost.exedescription pid process target process PID 3896 set thread context of 952 3896 095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exe svchost.exe PID 952 set thread context of 3520 952 svchost.exe Explorer.EXE PID 4040 set thread context of 3520 4040 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
svchost.exesvchost.exepid process 952 svchost.exe 952 svchost.exe 952 svchost.exe 952 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe 4040 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
svchost.exesvchost.exepid process 952 svchost.exe 952 svchost.exe 952 svchost.exe 4040 svchost.exe 4040 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 952 svchost.exe Token: SeDebugPrivilege 4040 svchost.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Explorer.EXEpid process 3520 Explorer.EXE 3520 Explorer.EXE 3520 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Explorer.EXEpid process 3520 Explorer.EXE 3520 Explorer.EXE 3520 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exeExplorer.EXEsvchost.exedescription pid process target process PID 3896 wrote to memory of 952 3896 095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exe svchost.exe PID 3896 wrote to memory of 952 3896 095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exe svchost.exe PID 3896 wrote to memory of 952 3896 095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exe svchost.exe PID 3896 wrote to memory of 952 3896 095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exe svchost.exe PID 3896 wrote to memory of 952 3896 095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exe svchost.exe PID 3896 wrote to memory of 952 3896 095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exe svchost.exe PID 3520 wrote to memory of 4040 3520 Explorer.EXE svchost.exe PID 3520 wrote to memory of 4040 3520 Explorer.EXE svchost.exe PID 3520 wrote to memory of 4040 3520 Explorer.EXE svchost.exe PID 4040 wrote to memory of 4608 4040 svchost.exe cmd.exe PID 4040 wrote to memory of 4608 4040 svchost.exe cmd.exe PID 4040 wrote to memory of 4608 4040 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\095d3e149a73c5daa7da04428ee3d561_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\svchost.exe"C:\\Windows\\SysWow64\\svchost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWow64\svchost.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-13-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/952-11-0x0000000001400000-0x000000000174A000-memory.dmpFilesize
3.3MB
-
memory/952-12-0x0000000001130000-0x0000000001140000-memory.dmpFilesize
64KB
-
memory/3520-27-0x00000000086F0000-0x0000000008824000-memory.dmpFilesize
1.2MB
-
memory/3520-24-0x00000000086F0000-0x0000000008824000-memory.dmpFilesize
1.2MB
-
memory/3520-23-0x00000000086F0000-0x0000000008824000-memory.dmpFilesize
1.2MB
-
memory/3520-20-0x000000000AA40000-0x000000000ABAE000-memory.dmpFilesize
1.4MB
-
memory/3520-14-0x000000000AA40000-0x000000000ABAE000-memory.dmpFilesize
1.4MB
-
memory/3896-4-0x0000000000F40000-0x0000000000F56000-memory.dmpFilesize
88KB
-
memory/3896-9-0x00007FFCFA420000-0x00007FFCFAEE1000-memory.dmpFilesize
10.8MB
-
memory/3896-6-0x00007FFCFA420000-0x00007FFCFAEE1000-memory.dmpFilesize
10.8MB
-
memory/3896-5-0x00000000011F0000-0x00000000011F4000-memory.dmpFilesize
16KB
-
memory/3896-0-0x00007FFCFA423000-0x00007FFCFA425000-memory.dmpFilesize
8KB
-
memory/3896-3-0x00000000011F0000-0x0000000001218000-memory.dmpFilesize
160KB
-
memory/3896-2-0x0000000000EE0000-0x0000000000F22000-memory.dmpFilesize
264KB
-
memory/3896-1-0x00000000005F0000-0x000000000064A000-memory.dmpFilesize
360KB
-
memory/4040-17-0x00000000004C0000-0x00000000004CE000-memory.dmpFilesize
56KB
-
memory/4040-15-0x00000000004C0000-0x00000000004CE000-memory.dmpFilesize
56KB
-
memory/4040-18-0x00000000001D0000-0x00000000001F8000-memory.dmpFilesize
160KB