Analysis Overview
SHA256
244dee4ae86c21c8d4f82e5e96ce2b96e24701f7351c7b0db767499e3d1438bc
Threat Level: Shows suspicious behavior
The file a3da30874741d7dd868ba606a4154b18_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Checks whether UAC is enabled
Unsigned PE
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 04:41
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 04:41
Reported
2024-06-13 04:43
Platform
win7-20240611-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | service.downloadadmin.com | udp |
| US | 23.23.235.104:80 | service.downloadadmin.com | tcp |
| US | 23.23.235.104:80 | service.downloadadmin.com | tcp |
Files
\Users\Admin\AppData\Local\Temp\XFgrckzuqEiUoEUqPSy\lua51.dll
| MD5 | f0c59526f8186eadaf2171b8fd2967c1 |
| SHA1 | 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb |
| SHA256 | 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6 |
| SHA512 | dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854 |
\Users\Admin\AppData\Local\Temp\XFgrckzuqEiUoEUqPSy\extramod.dll
| MD5 | d50a022a779f99d7031c57d7649b4f0a |
| SHA1 | d67910cac21822c05938b7d08961d12d429bb940 |
| SHA256 | 5439298289b12a4268082507d94296159dcfa4989b8c6f15424d3f53a4321004 |
| SHA512 | f0617caa72d4aacee9fba49ae12698d48f4da52c02ee464bc05dd36cd9d733aa735e0ae99154d5d8b9f17e0d5f3878351617857e9956a3bdd3a998e26dbcb482 |
memory/1972-5-0x0000000000670000-0x0000000000686000-memory.dmp
\Users\Admin\AppData\Local\Temp\XFgrckzuqEiUoEUqPSy\shared_library.dll
| MD5 | 2727bc0477d376159cc65698afc2efd5 |
| SHA1 | 738d046d3124bdaef841bc1b0c2cc9dd7222ff83 |
| SHA256 | 11e02621b32ce4994014d0143438e8ffd06087add67a2caac652bf68b6b07212 |
| SHA512 | 7feb6bad5742ed439885c1f5559a56fd8e339a962433d29e0ed300454d9907b260254d789c844f3ccba6f04f58069b68e4b2c40a0c3b2312654390eee008b652 |
memory/1972-10-0x0000000000820000-0x0000000000856000-memory.dmp
memory/1972-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/1972-14-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/1972-15-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/1972-17-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/1972-16-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
memory/1972-18-0x000000007EF90000-0x000000007EFA0000-memory.dmp
memory/1972-19-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
\Users\Admin\AppData\Local\Temp\XFgrckzuqEiUoEUqPSy\loading_screen.dll
| MD5 | 44dac7f87bdf94d553f8d2cf073d605d |
| SHA1 | 21bf5d714b9fcab32ba40ff7d36e48c378b67a06 |
| SHA256 | 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66 |
| SHA512 | 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774 |
memory/1972-25-0x000000007EF00000-0x000000007EF10000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 04:41
Reported
2024-06-13 04:43
Platform
win10v2004-20240508-en
Max time kernel
147s
Max time network
150s
Command Line
Signatures
Loads dropped DLL
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe | N/A |
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | service.downloadadmin.com | udp |
| US | 8.8.8.8:53 | service.downloadadmin.com | udp |
Files
C:\Users\Admin\AppData\Local\Temp\yQkFOFQO194LBPSuQxK\lua51.dll
| MD5 | f0c59526f8186eadaf2171b8fd2967c1 |
| SHA1 | 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb |
| SHA256 | 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6 |
| SHA512 | dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854 |
memory/3128-7-0x0000000002100000-0x0000000002116000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\yQkFOFQO194LBPSuQxK\extramod.dll
| MD5 | d50a022a779f99d7031c57d7649b4f0a |
| SHA1 | d67910cac21822c05938b7d08961d12d429bb940 |
| SHA256 | 5439298289b12a4268082507d94296159dcfa4989b8c6f15424d3f53a4321004 |
| SHA512 | f0617caa72d4aacee9fba49ae12698d48f4da52c02ee464bc05dd36cd9d733aa735e0ae99154d5d8b9f17e0d5f3878351617857e9956a3bdd3a998e26dbcb482 |
C:\Users\Admin\AppData\Local\Temp\yQkFOFQO194LBPSuQxK\shared_library.dll
| MD5 | 2727bc0477d376159cc65698afc2efd5 |
| SHA1 | 738d046d3124bdaef841bc1b0c2cc9dd7222ff83 |
| SHA256 | 11e02621b32ce4994014d0143438e8ffd06087add67a2caac652bf68b6b07212 |
| SHA512 | 7feb6bad5742ed439885c1f5559a56fd8e339a962433d29e0ed300454d9907b260254d789c844f3ccba6f04f58069b68e4b2c40a0c3b2312654390eee008b652 |
memory/3128-14-0x0000000002120000-0x0000000002156000-memory.dmp
memory/3128-21-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3128-22-0x000000007FE30000-0x000000007FE40000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\yQkFOFQO194LBPSuQxK\loading_screen.dll
| MD5 | 44dac7f87bdf94d553f8d2cf073d605d |
| SHA1 | 21bf5d714b9fcab32ba40ff7d36e48c378b67a06 |
| SHA256 | 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66 |
| SHA512 | 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774 |
memory/3128-20-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3128-19-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3128-18-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3128-17-0x000000007FE40000-0x000000007FE50000-memory.dmp
memory/3128-28-0x000000007FE40000-0x000000007FE50000-memory.dmp