Malware Analysis Report

2025-04-14 00:32

Sample ID 240601-w3yn8sbg62
Target 8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118
SHA256 95ece1e88d8b3c15824b552fc7573401fad8eef155f71848adb2e90cdd3c38b6
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

95ece1e88d8b3c15824b552fc7573401fad8eef155f71848adb2e90cdd3c38b6

Threat Level: Shows suspicious behavior

The file 8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary


Loads dropped DLL

Checks BIOS information in registry

Maps connected drives based on registry

Suspicious use of SetThreadContext

Program crash

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 18:27

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 18:27

Reported

2024-06-01 18:30

Platform

win7-20240215-en

Max time kernel

141s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe"

Signatures

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2924 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 2924 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 2924 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 2924 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 2924 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 2924 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 2924 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 2924 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 2924 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 2924 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 2924 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 2088 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe
PID 2088 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe
PID 2088 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe
PID 2088 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe" Track="0001001000"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 1372

Network

Country Destination Domain Proto
US 8.8.8.8:53 z1mhu2.oqs8xh4f.com udp

Files

memory/2088-0-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-4-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-8-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-2-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-16-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-6-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-10-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2088-17-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-14-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-18-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-19-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-20-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-22-0x0000000000400000-0x0000000000520000-memory.dmp

memory/2088-21-0x0000000000400000-0x0000000000520000-memory.dmp

\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe

MD5 8b5bec0cad4639b3fc4ae6f6f7f088a2
SHA1 027522d0dc1ab9b2992e442bf1089c296680b489
SHA256 95ece1e88d8b3c15824b552fc7573401fad8eef155f71848adb2e90cdd3c38b6
SHA512 f9592543de05c563bf91182255b780ac44a5fd3d4599df9095e192b8f5b2d9aae3f1eb6b7c3988b43a031bf40494a4f8b172d2a8d2bbf9f6ba42a8605e571b2a

memory/2088-31-0x0000000000400000-0x0000000000520000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 18:27

Reported

2024-06-01 18:30

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe"

Signatures

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 636 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 636 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 636 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 636 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 636 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 636 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 636 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 636 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 636 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe
PID 636 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\8b5bec0cad4639b3fc4ae6f6f7f088a2_JaffaCakes118.exe" Track="0001001000"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4676 -ip 4676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4676 -ip 4676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 2020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4044 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 cnefurxkihrkv2h.oqs8xh4f.com udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 73.239.69.13.in-addr.arpa udp

Files

memory/4676-0-0x0000000000400000-0x0000000000520000-memory.dmp

memory/4676-1-0x0000000000400000-0x0000000000520000-memory.dmp

memory/4676-2-0x0000000000400000-0x0000000000520000-memory.dmp

memory/4676-3-0x0000000000400000-0x0000000000520000-memory.dmp

memory/4676-4-0x0000000000400000-0x0000000000520000-memory.dmp

memory/4676-5-0x0000000000400000-0x0000000000520000-memory.dmp

memory/4676-6-0x0000000000400000-0x0000000000520000-memory.dmp

memory/4676-7-0x0000000000400000-0x0000000000520000-memory.dmp

memory/4676-11-0x0000000000400000-0x0000000000520000-memory.dmp