Malware Analysis Report

2024-11-13 13:27

Sample ID 240603-m65saacc31
Target 918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118
SHA256 ba06ee83b4b1928299aedbb9339c581ab2f38328c48adec2a633f57b86827685
Tags
discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

ba06ee83b4b1928299aedbb9339c581ab2f38328c48adec2a633f57b86827685

Threat Level: Shows suspicious behavior

The file 918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery

Executes dropped EXE

Checks installed software on the system

Maps connected drives based on registry

Drops file in Windows directory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 11:05

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 11:05

Reported

2024-06-03 11:08

Platform

win7-20240508-en

Max time kernel

121s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Republican Help\Republican Help.exe N/A

Checks installed software on the system

discovery

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\ExpertPlanner.job C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe"

C:\Users\Admin\AppData\Roaming\Republican Help\Republican Help.exe

"C:\Users\Admin\AppData\Roaming\Republican Help\Republican Help.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 parentmodel.biz udp
US 8.8.8.8:53 allmodel-pro.com udp
US 204.11.56.48:80 allmodel-pro.com tcp
US 8.8.8.8:53 moodmodel.biz udp
US 8.8.8.8:53 ringmynorth.biz udp

Files

memory/836-0-0x0000000000020000-0x0000000000021000-memory.dmp

memory/836-1-0x0000000000030000-0x0000000000031000-memory.dmp

memory/836-2-0x0000000000130000-0x0000000000131000-memory.dmp

memory/836-3-0x0000000000150000-0x0000000000179000-memory.dmp

memory/836-4-0x0000000000140000-0x0000000000141000-memory.dmp

memory/836-5-0x00000000001B0000-0x00000000001DF000-memory.dmp

memory/836-9-0x0000000000150000-0x0000000000179000-memory.dmp

memory/836-12-0x0000000000670000-0x0000000000697000-memory.dmp

memory/836-16-0x0000000000150000-0x0000000000179000-memory.dmp

C:\Users\Admin\AppData\Roaming\Republican Help\Republican Help.exe

MD5 3bc7eb78c8976d47e15336ab9d018686
SHA1 12b34b150f8ecafe5d8845f7b8dc46278ba6202a
SHA256 6ddb42d774cb64b71d36c5754cb54f55ab89bff44633843c553e9a003ae17784
SHA512 98b4c5f8b40de5aa115e11348dcabaaae3125216f68e10ca82f7a1c4b9beb8656d502fe0a112f1ff5ebc2fd7c70ef0e8a0de4bfdb3516f8ffdb0a3514b4e68c7

memory/836-25-0x0000000000150000-0x0000000000179000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 11:05

Reported

2024-06-03 11:08

Platform

win10v2004-20240226-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\ExpertPlanner.job C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\918d7fcc3ea7583bd23680ce91f4fb47_JaffaCakes118.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 142.250.178.10:443 tcp
US 8.8.8.8:53 parentmodel.biz udp
US 8.8.8.8:53 allmodel-pro.com udp
US 8.8.8.8:53 moodmodel.biz udp
US 8.8.8.8:53 ringmynorth.biz udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp

Files

memory/1140-1-0x0000000000950000-0x0000000000951000-memory.dmp

memory/1140-0-0x0000000000940000-0x0000000000941000-memory.dmp

memory/1140-2-0x0000000000960000-0x0000000000961000-memory.dmp

memory/1140-3-0x0000000000970000-0x0000000000971000-memory.dmp

memory/1140-4-0x0000000000980000-0x00000000009A9000-memory.dmp

memory/1140-9-0x0000000000980000-0x00000000009A9000-memory.dmp

memory/1140-5-0x00000000010B0000-0x00000000010DF000-memory.dmp

memory/1140-12-0x00000000022C0000-0x00000000022E7000-memory.dmp

memory/1140-16-0x0000000000980000-0x00000000009A9000-memory.dmp

memory/1140-18-0x0000000000980000-0x00000000009A9000-memory.dmp