Malware Analysis Report

2025-03-14 22:29

Sample ID 240407-2282gahd53
Target e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118
SHA256 0a38a8552c69ba75dbcb039496025c716480d8a4dec06a9816a9b483e8eb984f
Tags
persistence
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

0a38a8552c69ba75dbcb039496025c716480d8a4dec06a9816a9b483e8eb984f

Threat Level: Shows suspicious behavior

The file e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Adds Run key to start application

Drops file in Program Files directory

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

Runs net.exe

Gathers network information

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 23:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 23:05

Reported

2024-04-07 23:08

Platform

win7-20240221-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2112 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2112 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 2352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 2352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 2352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 2352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1812 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1812 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1812 wrote to memory of 2252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1812 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1812 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1812 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1812 wrote to memory of 2556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1812 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 1812 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 1812 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 1812 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2820 wrote to memory of 2600 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2820 wrote to memory of 2600 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2820 wrote to memory of 2600 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2820 wrote to memory of 2600 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1812 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 1812 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 1812 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 1812 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log

C:\Windows\SysWOW64\cmd.exe

cmd /c set

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /all

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\net.exe

net start

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start

C:\Windows\SysWOW64\NETSTAT.EXE

netstat -an

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.kvic.jp udp

Files

\??\c:\windows\temp\flash.log

MD5 816b388bfe41bd6d42a9e11f41a4a743
SHA1 4bd4ae0ed32a80af0811edf5b25092f04243c29c
SHA256 b62df06c981ce9dc1c285e0be5ee9d013a1d38876294fad02c16459f50c12b50
SHA512 f3541b05e1e74c30761636d8dcd6228c2e6000b7bcf489583a376b2553d8603954a4f64dea953768a822beacdc7dddc2ce11568690be87084e18b6d483f27943

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 23:05

Reported

2024-04-07 23:08

Platform

win10v2004-20240226-en

Max time kernel

92s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\NETSTAT.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2612 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2612 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2612 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3472 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3472 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3472 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3472 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 3472 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 3472 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 3472 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3472 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3472 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 3472 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 3472 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 3472 wrote to memory of 2440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2440 wrote to memory of 4936 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2440 wrote to memory of 4936 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2440 wrote to memory of 4936 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3472 wrote to memory of 2276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 3472 wrote to memory of 2276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE
PID 3472 wrote to memory of 2276 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\NETSTAT.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e61092367f5c41a433bc6b326a2cafcb_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log

C:\Windows\SysWOW64\cmd.exe

cmd /c set

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /all

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\net.exe

net start

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start

C:\Windows\SysWOW64\NETSTAT.EXE

netstat -an

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 www.kvic.jp udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

\??\c:\windows\temp\flash.log

MD5 bfade8e3a324a7afa69fe2e5ae401c3b
SHA1 ba8fb1c50e1460c0f5c371ee061bfbe17f9b8598
SHA256 e1199bc3ef9b4880f297f93cba1ade09603a800d51fa35d11b3cca35a817142e
SHA512 d04fcac651dd5d795d1f008c77fa5b9c7168687f93906de0393e67fc56c245374bb61ad2b3f6fd4746b0485100e2d56834153dc4b49a52531e1c60873d4283ad