Malware Analysis Report

2024-11-16 13:21

Sample ID 240613-fa6w5syanp
Target a3da30874741d7dd868ba606a4154b18_JaffaCakes118
SHA256 244dee4ae86c21c8d4f82e5e96ce2b96e24701f7351c7b0db767499e3d1438bc
Tags
evasion trojan
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

244dee4ae86c21c8d4f82e5e96ce2b96e24701f7351c7b0db767499e3d1438bc

Threat Level: Shows suspicious behavior

The file a3da30874741d7dd868ba606a4154b18_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

evasion trojan

Loads dropped DLL

Checks whether UAC is enabled

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 04:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 04:41

Reported

2024-06-13 04:43

Platform

win7-20240611-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"

Signatures

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2076 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 2076 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 2076 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 2076 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 2076 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 2076 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 2076 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 1968 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 1968 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 1968 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 1968 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 1968 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 1968 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe
PID 1968 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 service.downloadadmin.com udp
US 23.23.235.104:80 service.downloadadmin.com tcp
US 23.23.235.104:80 service.downloadadmin.com tcp

Files

\Users\Admin\AppData\Local\Temp\XFgrckzuqEiUoEUqPSy\lua51.dll

MD5 f0c59526f8186eadaf2171b8fd2967c1
SHA1 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA256 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512 dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

\Users\Admin\AppData\Local\Temp\XFgrckzuqEiUoEUqPSy\extramod.dll

MD5 d50a022a779f99d7031c57d7649b4f0a
SHA1 d67910cac21822c05938b7d08961d12d429bb940
SHA256 5439298289b12a4268082507d94296159dcfa4989b8c6f15424d3f53a4321004
SHA512 f0617caa72d4aacee9fba49ae12698d48f4da52c02ee464bc05dd36cd9d733aa735e0ae99154d5d8b9f17e0d5f3878351617857e9956a3bdd3a998e26dbcb482

memory/1972-5-0x0000000000670000-0x0000000000686000-memory.dmp

\Users\Admin\AppData\Local\Temp\XFgrckzuqEiUoEUqPSy\shared_library.dll

MD5 2727bc0477d376159cc65698afc2efd5
SHA1 738d046d3124bdaef841bc1b0c2cc9dd7222ff83
SHA256 11e02621b32ce4994014d0143438e8ffd06087add67a2caac652bf68b6b07212
SHA512 7feb6bad5742ed439885c1f5559a56fd8e339a962433d29e0ed300454d9907b260254d789c844f3ccba6f04f58069b68e4b2c40a0c3b2312654390eee008b652

memory/1972-10-0x0000000000820000-0x0000000000856000-memory.dmp

memory/1972-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

memory/1972-14-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

memory/1972-15-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

memory/1972-17-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

memory/1972-16-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

memory/1972-18-0x000000007EF90000-0x000000007EFA0000-memory.dmp

memory/1972-19-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

\Users\Admin\AppData\Local\Temp\XFgrckzuqEiUoEUqPSy\loading_screen.dll

MD5 44dac7f87bdf94d553f8d2cf073d605d
SHA1 21bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA256 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA512 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

memory/1972-25-0x000000007EF00000-0x000000007EF10000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 04:41

Reported

2024-06-13 04:43

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"

Signatures

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3da30874741d7dd868ba606a4154b18_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 service.downloadadmin.com udp
US 8.8.8.8:53 service.downloadadmin.com udp

Files

C:\Users\Admin\AppData\Local\Temp\yQkFOFQO194LBPSuQxK\lua51.dll

MD5 f0c59526f8186eadaf2171b8fd2967c1
SHA1 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA256 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512 dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

memory/3128-7-0x0000000002100000-0x0000000002116000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\yQkFOFQO194LBPSuQxK\extramod.dll

MD5 d50a022a779f99d7031c57d7649b4f0a
SHA1 d67910cac21822c05938b7d08961d12d429bb940
SHA256 5439298289b12a4268082507d94296159dcfa4989b8c6f15424d3f53a4321004
SHA512 f0617caa72d4aacee9fba49ae12698d48f4da52c02ee464bc05dd36cd9d733aa735e0ae99154d5d8b9f17e0d5f3878351617857e9956a3bdd3a998e26dbcb482

C:\Users\Admin\AppData\Local\Temp\yQkFOFQO194LBPSuQxK\shared_library.dll

MD5 2727bc0477d376159cc65698afc2efd5
SHA1 738d046d3124bdaef841bc1b0c2cc9dd7222ff83
SHA256 11e02621b32ce4994014d0143438e8ffd06087add67a2caac652bf68b6b07212
SHA512 7feb6bad5742ed439885c1f5559a56fd8e339a962433d29e0ed300454d9907b260254d789c844f3ccba6f04f58069b68e4b2c40a0c3b2312654390eee008b652

memory/3128-14-0x0000000002120000-0x0000000002156000-memory.dmp

memory/3128-21-0x000000007FE40000-0x000000007FE50000-memory.dmp

memory/3128-22-0x000000007FE30000-0x000000007FE40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\yQkFOFQO194LBPSuQxK\loading_screen.dll

MD5 44dac7f87bdf94d553f8d2cf073d605d
SHA1 21bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA256 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA512 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

memory/3128-20-0x000000007FE40000-0x000000007FE50000-memory.dmp

memory/3128-19-0x000000007FE40000-0x000000007FE50000-memory.dmp

memory/3128-18-0x000000007FE40000-0x000000007FE50000-memory.dmp

memory/3128-17-0x000000007FE40000-0x000000007FE50000-memory.dmp

memory/3128-28-0x000000007FE40000-0x000000007FE50000-memory.dmp