Malware Analysis Report

2025-04-14 03:21

Sample ID 240613-fn89esyepn
Target a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118
SHA256 dbf5c857bdab81196d45c08b69188ac3eb32979776238f197a3d77c508c6f026
Tags
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

dbf5c857bdab81196d45c08b69188ac3eb32979776238f197a3d77c508c6f026

Threat Level: Likely malicious

The file a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary


Downloads MZ/PE file

Loads dropped DLL

Executes dropped EXE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-13 05:02

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 05:02

Reported

2024-06-13 05:04

Platform

win7-20240611-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe"

Signatures

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp
PID 2916 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp
PID 2916 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp
PID 2916 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp
PID 2916 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp
PID 2916 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp
PID 2916 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp

"C:\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp" /SL5="$30134,1335443,121344,C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 post.securestudies.com udp
US 165.193.78.234:80 post.securestudies.com tcp
US 165.193.78.234:80 post.securestudies.com tcp
US 8.8.8.8:53 dpd.securestudies.com udp
HR 65.9.189.49:443 dpd.securestudies.com tcp
HR 65.9.189.49:443 dpd.securestudies.com tcp

Files

memory/2916-2-0x0000000000401000-0x0000000000412000-memory.dmp

memory/2916-0-0x0000000000400000-0x0000000000428000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-0C6IS.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp

MD5 34acc2bdb45a9c436181426828c4cb49
SHA1 5adaa1ac822e6128b8d4b59a54d19901880452ae
SHA256 9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512 134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

memory/2988-9-0x0000000000400000-0x000000000052E000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-2I51G.tmp\itdownload.dll

MD5 d82a429efd885ca0f324dd92afb6b7b8
SHA1 86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256 b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA512 5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

memory/2988-13-0x0000000000930000-0x000000000096C000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-2I51G.tmp\isxdl.dll

MD5 48ad1a1c893ce7bf456277a0a085ed01
SHA1 803997ef17eedf50969115c529a2bf8de585dc91
SHA256 b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA512 7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

\Users\Admin\AppData\Local\Temp\is-2I51G.tmp\OqIEFuprtaC.dll

MD5 16090d48f4c90ffc959e878e7e697cbd
SHA1 dba2748e05b8b2c1f7d8fd7f9c677764a3365946
SHA256 e61ea546a518289762cb8ba240863f5c8f82b9c8de5d44281d1af3bc6c1104c6
SHA512 5679ecbf8fbb795660f225f5712aa16a6e26a34615cb7eb04e5a6ba1165fd10a775d9ae09871f83e2fb8f1628320187cb56ad62be6a4a8b8aae9227845375403

memory/2988-20-0x0000000005890000-0x000000000599E000-memory.dmp

memory/2916-24-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2988-26-0x0000000000930000-0x000000000096C000-memory.dmp

memory/2988-25-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2988-27-0x0000000005890000-0x000000000599E000-memory.dmp

memory/2988-61-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2988-70-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2916-72-0x0000000000400000-0x0000000000428000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 05:02

Reported

2024-06-13 05:04

Platform

win10v2004-20240508-en

Max time kernel

106s

Max time network

56s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-8BICF.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\is-8BICF.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp

"C:\Users\Admin\AppData\Local\Temp\is-8BICF.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp" /SL5="$601C8,1335443,121344,C:\Users\Admin\AppData\Local\Temp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 post.securestudies.com udp
US 8.8.8.8:53 post.securestudies.com udp
US 8.8.8.8:53 post.securestudies.com udp
US 8.8.8.8:53 post.securestudies.com udp

Files

memory/4564-0-0x0000000000400000-0x0000000000428000-memory.dmp

memory/4564-2-0x0000000000401000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-8BICF.tmp\a3e7551212f7005c156d853bf22ce5a8_JaffaCakes118.tmp

MD5 34acc2bdb45a9c436181426828c4cb49
SHA1 5adaa1ac822e6128b8d4b59a54d19901880452ae
SHA256 9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512 134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

memory/3984-6-0x0000000000400000-0x000000000052E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-TG9DN.tmp\itdownload.dll

MD5 d82a429efd885ca0f324dd92afb6b7b8
SHA1 86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256 b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA512 5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

memory/3984-13-0x00000000032F0000-0x000000000332C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-TG9DN.tmp\isxdl.dll

MD5 48ad1a1c893ce7bf456277a0a085ed01
SHA1 803997ef17eedf50969115c529a2bf8de585dc91
SHA256 b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA512 7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

C:\Users\Admin\AppData\Local\Temp\is-TG9DN.tmp\OqIEFuprtaC.dll

MD5 16090d48f4c90ffc959e878e7e697cbd
SHA1 dba2748e05b8b2c1f7d8fd7f9c677764a3365946
SHA256 e61ea546a518289762cb8ba240863f5c8f82b9c8de5d44281d1af3bc6c1104c6
SHA512 5679ecbf8fbb795660f225f5712aa16a6e26a34615cb7eb04e5a6ba1165fd10a775d9ae09871f83e2fb8f1628320187cb56ad62be6a4a8b8aae9227845375403

memory/3984-22-0x0000000004B30000-0x0000000004C3E000-memory.dmp

memory/4564-24-0x0000000000400000-0x0000000000428000-memory.dmp

memory/3984-25-0x0000000000400000-0x000000000052E000-memory.dmp

memory/3984-26-0x00000000032F0000-0x000000000332C000-memory.dmp

memory/3984-27-0x0000000004B30000-0x0000000004C3E000-memory.dmp

memory/3984-33-0x0000000000400000-0x000000000052E000-memory.dmp

memory/3984-34-0x00000000032F0000-0x000000000332C000-memory.dmp

memory/3984-37-0x0000000000400000-0x000000000052E000-memory.dmp

memory/3984-38-0x00000000032F0000-0x000000000332C000-memory.dmp

memory/3984-61-0x0000000000400000-0x000000000052E000-memory.dmp

memory/3984-68-0x0000000000400000-0x000000000052E000-memory.dmp

memory/4564-70-0x0000000000400000-0x0000000000428000-memory.dmp