Malware Analysis Report

2024-10-18 21:40

Sample ID 240612-q5eq9axcpd
Target a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118
SHA256 a1b7b3c80c80febd8d6b1358cba8492a540234215a2bfbe0dc7d49683e6fac44
Tags
persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a1b7b3c80c80febd8d6b1358cba8492a540234215a2bfbe0dc7d49683e6fac44

Threat Level: Known bad

The file a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

persistence ransomware

Modifies WinLogon for persistence

Renames multiple (93) files with added filename extension

Drops startup file

Loads dropped DLL

Executes dropped EXE

Enumerates connected drives

Drops autorun.inf file

Drops file in System32 directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 13:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 13:50

Reported

2024-06-12 13:52

Platform

win7-20240611-en

Max time kernel

145s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" C:\Windows\SysWOW64\HelpMe.exe N/A

Renames multiple (93) files with added filename extension

ransomware

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk C:\Windows\SysWOW64\HelpMe.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk C:\Windows\SysWOW64\HelpMe.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\HelpMe.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\HelpMe.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification F:\AUTORUN.INF C:\Windows\SysWOW64\HelpMe.exe N/A
File opened for modification C:\AUTORUN.INF C:\Windows\SysWOW64\HelpMe.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\notepad.exe.exe C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\HelpMe.exe C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\HelpMe.exe C:\Windows\SysWOW64\HelpMe.exe N/A
File opened for modification C:\Windows\SysWOW64\HelpMe.exe C:\Windows\SysWOW64\HelpMe.exe N/A
File created C:\Windows\SysWOW64\notepad.exe.exe C:\Windows\SysWOW64\HelpMe.exe N/A
File opened for modification C:\Windows\SysWOW64\HelpMe.exe C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe C:\Windows\SysWOW64\HelpMe.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\HelpMe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe"

C:\Windows\SysWOW64\HelpMe.exe

C:\Windows\system32\HelpMe.exe

Network

N/A

Files

memory/2384-0-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2384-2-0x0000000000220000-0x0000000000221000-memory.dmp

\Windows\SysWOW64\HelpMe.exe

MD5 96c6cd4e81790949780f17a02975e2d0
SHA1 c8090a2cc130d772dbf88f6f1bc3bd19eba5a2ec
SHA256 0b09876b0b50fb10766ad32c2c13bac101f59c58c347a80459ef8aff86e84aa2
SHA512 664cd14591a39635661f1b16e11ef0f98f6430e689ac1e2e3ff057c8706512f7cf6ac6137c7b074cfaeacce3a162c797b1845cfc90ffd3777c1127af49ce5abd

memory/2384-4-0x0000000000700000-0x0000000000778000-memory.dmp

memory/1680-11-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1680-13-0x0000000000220000-0x0000000000221000-memory.dmp

C:\Windows\SysWOW64\notepad.exe.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe

MD5 d9b048fdefad444456d175cd6e55be2d
SHA1 6afb6560fbd9d3985ee8ba5ff98b87b55b9f8da2
SHA256 921d549f06b6e6a696873ff84517eea15254305fa3a0a7aaf8d1320ebba3982c
SHA512 da6c64b6f1cfe4358ffab69ee52b2e95ab82545e0eee46e6a620763263eff779089b9ada7b9f4fdbe4332651b43800d0223a51fd8ad0277f78dbe3d41b14037f

memory/2384-26-0x0000000000400000-0x0000000000478000-memory.dmp

F:\AUTORUN.INF

MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

C:\$Recycle.Bin\S-1-5-21-2812790648-3157963462-487717889-1000\desktop.ini.exe

MD5 fa19141673ee216aaf0da50afedbea14
SHA1 63e1a54989db59048168a1f2d29ece121836fd49
SHA256 289d4943e45d6271caec0f9f6fc2e38181a645e24a4048a06fb9bde0c9744ab1
SHA512 84ddf2fd3b16eb54e4dbf16a5f876070c152c628d1b43b0d702485514a0d3746de4dfbf1b2ea5112475c9ae1bbc064bfbdd707daac3fd1bc6061f1a671413856

memory/1680-249-0x0000000000400000-0x0000000000478000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

MD5 26717fccee3ef2eb47a48dfdba879cf6
SHA1 f72edbad5ae0b7a5b4dbffd42bb03d8aa6e26304
SHA256 8cf692e99520e2b19e8d57207d3075881dad46fdf7da4146af16145ae63173d2
SHA512 e08ba9422b42c74e8514c1e73ae37979ee4f3fe436ef8bc6622c0599565658093437647e6656485ce1b9d4a11e53485e54758f5f35e036a3c18972d0f1a4713e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 13:50

Reported

2024-06-12 13:52

Platform

win10v2004-20240611-en

Max time kernel

145s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" C:\Windows\SysWOW64\HelpMe.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk C:\Windows\SysWOW64\HelpMe.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk C:\Windows\SysWOW64\HelpMe.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\HelpMe.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\HelpMe.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\HelpMe.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification F:\AUTORUN.INF C:\Windows\SysWOW64\HelpMe.exe N/A
File opened for modification C:\AUTORUN.INF C:\Windows\SysWOW64\HelpMe.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\HelpMe.exe C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\HelpMe.exe C:\Windows\SysWOW64\HelpMe.exe N/A
File opened for modification C:\Windows\SysWOW64\HelpMe.exe C:\Windows\SysWOW64\HelpMe.exe N/A
File created C:\Windows\SysWOW64\notepad.exe.exe C:\Windows\SysWOW64\HelpMe.exe N/A
File opened for modification C:\Windows\SysWOW64\HelpMe.exe C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad.exe.exe C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe C:\Windows\SysWOW64\HelpMe.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a0e2d36c6dc3a660509580a4c43cfd34_JaffaCakes118.exe"

C:\Windows\SysWOW64\HelpMe.exe

C:\Windows\system32\HelpMe.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
BE 2.17.196.65:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 65.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp

Files

memory/3856-0-0x0000000000400000-0x0000000000478000-memory.dmp

memory/3856-1-0x00000000021D0000-0x00000000021D1000-memory.dmp

C:\Windows\SysWOW64\HelpMe.exe

MD5 96c6cd4e81790949780f17a02975e2d0
SHA1 c8090a2cc130d772dbf88f6f1bc3bd19eba5a2ec
SHA256 0b09876b0b50fb10766ad32c2c13bac101f59c58c347a80459ef8aff86e84aa2
SHA512 664cd14591a39635661f1b16e11ef0f98f6430e689ac1e2e3ff057c8706512f7cf6ac6137c7b074cfaeacce3a162c797b1845cfc90ffd3777c1127af49ce5abd

memory/3800-6-0x0000000000750000-0x0000000000751000-memory.dmp

C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe

MD5 2d5577ed73a5549c17ad9cf96874da98
SHA1 86f5f257e07f30434a93d2a5ba8f3796a2473f61
SHA256 4b3d7e2c90834f6214da7698e33a0a69459e0a57d3a3acf6796481e762f128de
SHA512 1c0476d5ef4038108e7aec69100e9cfba0400a2817b838b17b07d08bed8feac35e257230b5ce5f3b5d97298592b867a0a31c8ce701fcc170b1af8f6af7ea4620

C:\Windows\SysWOW64\notepad.exe.exe

MD5 b099c2d686015e14bd2d0b8dbb598e82
SHA1 316dbd9cc287d22eeb93984797bedda73ad761b3
SHA256 a7ad9c7de2f56fb627cb947673f2996cfe4dcba9e36ea6bff85a8b4539c81b8f
SHA512 f9674f4ebaa3c5304492dc305e3a648f65499c411c65d010cd1f0b2b8cdc2f634b9a0b5c972664243f9223821e0f34b007699d43fdd4827e329b555ce4633f10

memory/3856-19-0x0000000000400000-0x0000000000478000-memory.dmp

F:\AUTORUN.INF

MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.exe

MD5 d4cc100663b30789283fa13a9440f286
SHA1 9116ceb8225e3b302e67b4c27eba2ef703b634e1
SHA256 af1298703a74412a6d8a3daf701a70c4448ec1b26d5ca3ebd426979e53e3640e
SHA512 6dcc0e7b0bd66be3a61dc08423613dc9a8b6b4a00de9b7371a07bfc5ed5fd8de1077c34728cbf6fc05021a98c8a154324f9a8c7b9b24e30afd745cd38b5631fe

memory/3800-68-0x0000000000400000-0x0000000000478000-memory.dmp

memory/3800-69-0x0000000000750000-0x0000000000751000-memory.dmp