Malware Analysis Report

2025-03-14 23:42

Sample ID 240407-xg9eaabg76
Target e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118
SHA256 bd370f0bbb80019c52097d59e5669480062dcf09a914f7057697861c44e6c5fb
Tags
evasion persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

bd370f0bbb80019c52097d59e5669480062dcf09a914f7057697861c44e6c5fb

Threat Level: Likely malicious

The file e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

evasion persistence

Uses Session Manager for persistence

Modifies Windows Firewall

Stops running service(s)

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Program crash

Unsigned PE

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 18:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 18:50

Reported

2024-04-07 18:53

Platform

win7-20240221-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe"

Signatures

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Stops running service(s)

evasion

Uses Session Manager for persistence

persistence
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 C:\Windows\SysWOW64\reg.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 C:\Windows\SysWOW64\reg.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winexec32 = "C:\\windows\\system\\win.exe" C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\chkcheck0001.txt C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\windows\system\win.exe C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2004 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2004 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2004 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2004 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\schtasks.exe
PID 2004 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2004 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2004 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2004 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2004 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\reg.exe
PID 2004 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2004 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2004 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2004 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn startt /tr c:\start.bat /sc onstart /ru system

C:\Windows\SysWOW64\sc.exe

sc delete GbpSv

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram C:\windows\system\win.exe RPCCC

Network

Country Destination Domain Proto
US 8.8.8.8:53 icked.servegame.org udp
US 8.8.8.8:53 kromeangels.my-webs.org udp
US 199.59.243.225:80 kromeangels.my-webs.org tcp
US 8.8.8.8:53 zillion.servegame.org udp

Files

memory/2004-1-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-0-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-3-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-2-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-4-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-5-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-8-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-9-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-7-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-6-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-10-0x0000000074FC0000-0x0000000074FC9000-memory.dmp

memory/2004-11-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2004-12-0x0000000075AF0000-0x0000000075AFA000-memory.dmp

memory/2004-13-0x00000000750F0000-0x00000000750FC000-memory.dmp

memory/2004-14-0x0000000075960000-0x0000000075A50000-memory.dmp

memory/2004-17-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-18-0x00000000749E0000-0x0000000074A2F000-memory.dmp

memory/2004-19-0x00000000776B0000-0x00000000776B6000-memory.dmp

memory/2004-16-0x0000000074A30000-0x0000000074A88000-memory.dmp

memory/2004-20-0x0000000074A30000-0x0000000074A37000-memory.dmp

memory/2004-22-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-21-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-25-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-27-0x000000007EF50000-0x000000007EFAC000-memory.dmp

memory/2004-26-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-28-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2004-29-0x0000000075AF0000-0x0000000075AFA000-memory.dmp

memory/2004-30-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-31-0x00000000750F0000-0x00000000750FC000-memory.dmp

memory/2004-32-0x0000000075960000-0x0000000075A50000-memory.dmp

memory/2004-33-0x0000000074A30000-0x0000000074A88000-memory.dmp

memory/2004-34-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-35-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-36-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-37-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-38-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-39-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-40-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-41-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-42-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-43-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-44-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/2004-45-0x0000000000400000-0x0000000001A15000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 18:50

Reported

2024-04-07 18:53

Platform

win10v2004-20240226-en

Max time kernel

93s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e59dca85902bb70d7d68aa4fed77abfd_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1328 -ip 1328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1328 -ip 1328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 572

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp

Files

memory/1328-0-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

memory/1328-2-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/1328-1-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

memory/1328-3-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

memory/1328-4-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

memory/1328-5-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

memory/1328-6-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

memory/1328-8-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

memory/1328-7-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

memory/1328-9-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

memory/1328-10-0x0000000000400000-0x0000000001A15000-memory.dmp

memory/1328-12-0x000000007FDF0000-0x000000007FE4C000-memory.dmp