Malware Analysis Report

2024-09-11 13:00

Sample ID 240613-2ehk1asgrd
Target a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118
SHA256 20c8110d58cb97f5332287c1f2724972556f37e07e0d104db6ecf545cd2c8317
Tags
evasion trojan
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

20c8110d58cb97f5332287c1f2724972556f37e07e0d104db6ecf545cd2c8317

Threat Level: Shows suspicious behavior

The file a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

evasion trojan

Loads dropped DLL

Checks whether UAC is enabled

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 22:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 22:29

Reported

2024-06-13 22:32

Platform

win7-20231129-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1068 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 1068 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 1068 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 1068 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 1068 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 1068 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 1068 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 2880 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 2880 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 2880 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 2880 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 2880 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 2880 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 2880 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 service.downloadadmin.com udp
US 23.23.235.104:80 service.downloadadmin.com tcp
US 23.23.235.104:80 service.downloadadmin.com tcp

Files

\Users\Admin\AppData\Local\Temp\SdnK9E277CTltRb7aqw\lua51.dll

MD5 f0c59526f8186eadaf2171b8fd2967c1
SHA1 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA256 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512 dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

\Users\Admin\AppData\Local\Temp\SdnK9E277CTltRb7aqw\extramod.dll

MD5 de0e519efcb1160b192195c4f663b935
SHA1 f4766c24e627addcbc0c307e60da0b4e46108f5e
SHA256 16c155f84d5639af0c055aab6a7f19664b6d451f7ac588c003b5e860bcccd473
SHA512 0449cb4659cdc02ac304bfcdd56f7dc2215aa36ec2c054c10a8040d89d2d62e60bc09b5bc8abf901c312ad4c1bd9e0ec8717effa19bb9337074fd556086c9b29

memory/2212-5-0x0000000000350000-0x0000000000366000-memory.dmp

\Users\Admin\AppData\Local\Temp\SdnK9E277CTltRb7aqw\shared_library.dll

MD5 62696d6b8d348aa616c02cb239598d75
SHA1 8e838f47735031715e1c292aaf81218b0eb45414
SHA256 d162a5470f31a7b9968b423e9b5990fb1c69645c242e595f21b58c45cba0cd0a
SHA512 062deeb906832a7417aafeeca78e9256704bc1f6738f64550a3f6fc205dbaae173d544ee44559f581902cf871f4ca1e4969059266646ad914ba575c4ad3570ca

memory/2212-10-0x0000000001D30000-0x0000000001D66000-memory.dmp

memory/2212-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

memory/2212-14-0x000000007EF90000-0x000000007EFA0000-memory.dmp

\Users\Admin\AppData\Local\Temp\SdnK9E277CTltRb7aqw\loading_screen.dll

MD5 44dac7f87bdf94d553f8d2cf073d605d
SHA1 21bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA256 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA512 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

memory/2212-20-0x000000007EF00000-0x000000007EF10000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:29

Reported

2024-06-13 22:32

Platform

win10v2004-20240611-en

Max time kernel

91s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1280 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 1280 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 1280 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 1512 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 1512 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe
PID 1512 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a6e3af8e964fe9145ff63d655bfaac1a_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 service.downloadadmin.com udp
US 8.8.8.8:53 g.bing.com udp
US 18.233.221.25:80 service.downloadadmin.com tcp
US 18.233.221.25:80 service.downloadadmin.com tcp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 25.221.233.18.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 98.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\tPb6k7qwhNHcG60CrgI\lua51.dll

MD5 f0c59526f8186eadaf2171b8fd2967c1
SHA1 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA256 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512 dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

C:\Users\Admin\AppData\Local\Temp\tPb6k7qwhNHcG60CrgI\extramod.dll

MD5 de0e519efcb1160b192195c4f663b935
SHA1 f4766c24e627addcbc0c307e60da0b4e46108f5e
SHA256 16c155f84d5639af0c055aab6a7f19664b6d451f7ac588c003b5e860bcccd473
SHA512 0449cb4659cdc02ac304bfcdd56f7dc2215aa36ec2c054c10a8040d89d2d62e60bc09b5bc8abf901c312ad4c1bd9e0ec8717effa19bb9337074fd556086c9b29

memory/1352-7-0x0000000000610000-0x0000000000626000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tPb6k7qwhNHcG60CrgI\shared_library.dll

MD5 62696d6b8d348aa616c02cb239598d75
SHA1 8e838f47735031715e1c292aaf81218b0eb45414
SHA256 d162a5470f31a7b9968b423e9b5990fb1c69645c242e595f21b58c45cba0cd0a
SHA512 062deeb906832a7417aafeeca78e9256704bc1f6738f64550a3f6fc205dbaae173d544ee44559f581902cf871f4ca1e4969059266646ad914ba575c4ad3570ca

memory/1352-14-0x0000000002050000-0x0000000002086000-memory.dmp

memory/1352-17-0x000000007FE40000-0x000000007FE50000-memory.dmp

memory/1352-18-0x000000007FE30000-0x000000007FE40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tPb6k7qwhNHcG60CrgI\loading_screen.dll

MD5 44dac7f87bdf94d553f8d2cf073d605d
SHA1 21bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA256 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA512 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

memory/1352-24-0x000000007FE40000-0x000000007FE50000-memory.dmp