Malware Analysis Report

2024-11-15 05:27

Sample ID 240613-b2tcxazbmh
Target a36601d1d5377e250316a09ddd944293_JaffaCakes118
SHA256 fbc56edfa84eb772836844811d9a28855d88e53095656efd5548b3551fb645be
Tags
discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

fbc56edfa84eb772836844811d9a28855d88e53095656efd5548b3551fb645be

Threat Level: Shows suspicious behavior

The file a36601d1d5377e250316a09ddd944293_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery

Loads dropped DLL

Checks installed software on the system

Maps connected drives based on registry

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 01:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 01:38

Reported

2024-06-13 01:41

Platform

win7-20240220-en

Max time kernel

118s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe"

Signatures

Checks installed software on the system

discovery

Maps connected drives based on registry

Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin3EE2.bat"

Network

Country Destination Domain Proto
US 8.8.8.8:53 r1.getapplicationmy.info udp
US 8.8.8.8:53 c1.getapplicationmy.info udp
GB 94.229.72.116:80 c1.getapplicationmy.info tcp
GB 94.229.72.116:80 c1.getapplicationmy.info tcp
US 8.8.8.8:53 survey-smiles.com udp
US 199.59.243.226:80 survey-smiles.com tcp
GB 94.229.72.116:80 c1.getapplicationmy.info tcp
US 199.59.243.226:80 survey-smiles.com tcp

Files

\Users\Admin\AppData\Local\Temp\Tsu813DE590.dll

MD5 af7ce801c8471c5cd19b366333c153c4
SHA1 4267749d020a362edbd25434ad65f98b073581f1
SHA256 cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA512 88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

\Users\Admin\AppData\Local\Temp\{2F912130-9B16-4628-A4C3-D334F47203C6}\_Setup.dll

MD5 b040c43d630d3740abefba186f46883b
SHA1 c3c498b0cc6d34423780e8285cb3dc998ce1c4a3
SHA256 dd6dd4df86f215bea1c5b68cb7677dee75cda6cbbbf39ac040d67c992f6146df
SHA512 a3e3305ce4925aee378b1a3ed3e58daa743990fe809ac1b3c90640a2fa53736133a8f16c6e8314b5f243ed1109d24e683142d45f1d502cf3714edd748b3c9f5c

\Users\Admin\AppData\Local\Temp\{2F912130-9B16-4628-A4C3-D334F47203C6}\Custom.dll

MD5 52ffb9f31fcf351bed204ed2fa781954
SHA1 7acb17bc45cf6edc71726e59fb8a1d37eca51a55
SHA256 eb99eb74c3736102b174d6d7ff9afaa43bab8ad4bccfac53bb4dbb80392aa1d4
SHA512 841c2683068522077d6f347c17d59815bf5f94015d6b539f6a3248c00bfb8a56360c2c7b3c8960dbda497e76fb88f8859bb5c1a7f80b24fe03dbf00db187f4b9

C:\ProgramData\InstallMate\BD8223CE\cfg\1.ini

MD5 ae30d305b37acc71df1c8df6f6f70099
SHA1 474dc75a045fce3b1e28582188cdfc0da1fca220
SHA256 44c7c6a21f6de5e97572cb7ced42f63c88d2f8b41ca1fb00a26c69a3944dc3ea
SHA512 0c81dba06e36e25968417525a02d1004803832691357e656bf9ffa633f3b6569ea96c5d9925d60d17a2ec7502554a533fa8aa330973dc042e726f86ec64f6c44

C:\Users\Admin\AppData\Local\Temp\_tin3EE2.bat

MD5 d757ce2624e744f033ec2602ca64fba1
SHA1 524394e8cacb2ebccded57d82fd5dbbf58fb00b9
SHA256 394a3463100d983b65e43d24ee17000afdcc3e571dfb22b2bb49cc0925af8f0c
SHA512 981cc064e892faf9a7dfac0623f3352219bcf12e1d9350d2c58a3b6e6e1ce1c05ac66ef495a4e141fd90c04c0d171353322ad55cc7b264bbe38e9c2656c4d8c9

C:\Users\Admin\AppData\Local\Temp\{2F912130-9B16-4628-A4C3-D334F47203C6}\Setup.exe

MD5 e717f6ce3a7429bfa6d7f3cf66737a4b
SHA1 01f4042589b4ed88c351ffeac256be7a9d884818
SHA256 7be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633
SHA512 65a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80

C:\Users\Admin\AppData\Local\Temp\{2F912130-9B16-4628-A4C3-D334F47203C6}\Readme.txt

MD5 2980425cd6aa72d796478da717afe401
SHA1 880b0fb1cf65e0ffef74d8ba8302acea30a107c5
SHA256 bec01271e5ea03f709355bf734b70fcf5139046dbe3002a5baffcba12fe6632e
SHA512 9088c2506560c41277c1ea19d53b67d8a177edda362175a6985afe45e2e7721a8d5c901e2172ceec6d24b5b07610845c8f599a86e2b991f2bc684f2a0b61a8b6

C:\Users\Admin\AppData\Local\Temp\{2F912130-9B16-4628-A4C3-D334F47203C6}\Setup.ico

MD5 f77f10074521602a95354d87745569b5
SHA1 9a174bd576caaced672891d2df98e150c07d59e5
SHA256 117031dbff146e33fdf41527f9d37935418cbff079ad22466d0fd5a7d2895ea3
SHA512 a71e1bb898c65b2e78e2aaca0591794f5a75e67580802ff1e5246bbe75389f909f21f14fca7d5faae7b39f54e215c009bc3fe9a2ea774d82600bc406d4e0a7ca

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 01:38

Reported

2024-06-13 01:41

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe"

Signatures

Checks installed software on the system

discovery

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a36601d1d5377e250316a09ddd944293_JaffaCakes118.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4836,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 r1.getapplicationmy.info udp
US 8.8.8.8:53 c1.getapplicationmy.info udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 r2.getapplicationmy.info udp
US 8.8.8.8:53 c2.getapplicationmy.info udp
US 8.8.8.8:53 c1.getapplicationmy.info udp

Files

C:\Users\Admin\AppData\Local\Temp\Tsu8541AC7E.dll

MD5 af7ce801c8471c5cd19b366333c153c4
SHA1 4267749d020a362edbd25434ad65f98b073581f1
SHA256 cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA512 88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

C:\Users\Admin\AppData\Local\Temp\{DBC4C3DA-90F4-490F-ABE4-D8D60027E12C}\_Setup.dll

MD5 b040c43d630d3740abefba186f46883b
SHA1 c3c498b0cc6d34423780e8285cb3dc998ce1c4a3
SHA256 dd6dd4df86f215bea1c5b68cb7677dee75cda6cbbbf39ac040d67c992f6146df
SHA512 a3e3305ce4925aee378b1a3ed3e58daa743990fe809ac1b3c90640a2fa53736133a8f16c6e8314b5f243ed1109d24e683142d45f1d502cf3714edd748b3c9f5c

C:\Users\Admin\AppData\Local\Temp\{DBC4C3DA-90F4-490F-ABE4-D8D60027E12C}\Custom.dll

MD5 52ffb9f31fcf351bed204ed2fa781954
SHA1 7acb17bc45cf6edc71726e59fb8a1d37eca51a55
SHA256 eb99eb74c3736102b174d6d7ff9afaa43bab8ad4bccfac53bb4dbb80392aa1d4
SHA512 841c2683068522077d6f347c17d59815bf5f94015d6b539f6a3248c00bfb8a56360c2c7b3c8960dbda497e76fb88f8859bb5c1a7f80b24fe03dbf00db187f4b9