Malware Analysis Report

2024-09-11 13:00

Sample ID 240613-r1eq5ashra
Target a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118
SHA256 12d4a8b1e8dabee0e01805baf185004565db604a3a9cfb06836024626424c31b
Tags
evasion trojan
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

12d4a8b1e8dabee0e01805baf185004565db604a3a9cfb06836024626424c31b

Threat Level: Shows suspicious behavior

The file a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

evasion trojan

Loads dropped DLL

Checks whether UAC is enabled

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 14:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 14:39

Reported

2024-06-13 14:41

Platform

win7-20240611-en

Max time kernel

122s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1720 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1720 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1720 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1720 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1720 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1720 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1720 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1916 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1916 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1916 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1916 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1916 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1916 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 1916 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 service.downloadadmin.com udp
US 18.233.221.25:80 service.downloadadmin.com tcp
US 18.233.221.25:80 service.downloadadmin.com tcp

Files

\Users\Admin\AppData\Local\Temp\E5slICxagpqt5kQnnbi\lua51.dll

MD5 f0c59526f8186eadaf2171b8fd2967c1
SHA1 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA256 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512 dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

memory/2072-5-0x0000000000260000-0x0000000000276000-memory.dmp

\Users\Admin\AppData\Local\Temp\E5slICxagpqt5kQnnbi\extramod.dll

MD5 c41cfcef3e866372a37d34ef8483c0f9
SHA1 7ba6edd190e0ee5f9ede3adc0698386d14975622
SHA256 47def8ff1f6b2a4cb249a0e79144445f627cfcb6516bdbd7b64335efb856b0f9
SHA512 dd1829021c0afcf914effa77a3d7210736d9db12cfb7ae639c675566f4fbca57dedda2b7789bc9cb77b97960f5531b1f432df9dde8053924344bdc1805ee8ab5

\Users\Admin\AppData\Local\Temp\E5slICxagpqt5kQnnbi\shared_library.dll

MD5 ac7bc4b973cc32527e8500b8e925f88b
SHA1 c3fba0600b705a6fb6e83ddcb75c64d0009d2e41
SHA256 486c267edff7061fac7959c1e42a623e185288401648d85e730b95c10dec2a4d
SHA512 6140a614f845c3f03a26a737e7d077e4ed480a56b0a447c9e672c0d41ffca0b7b9bbc51e57d1809fc686aedba694f299c97da881cbc1a71d8da3e46efa2d6636

memory/2072-10-0x0000000000280000-0x00000000002B6000-memory.dmp

memory/2072-13-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

memory/2072-14-0x000000007EF90000-0x000000007EFA0000-memory.dmp

memory/2072-15-0x000000007EFA0000-0x000000007EFB0000-memory.dmp

\Users\Admin\AppData\Local\Temp\E5slICxagpqt5kQnnbi\loading_screen.dll

MD5 44dac7f87bdf94d553f8d2cf073d605d
SHA1 21bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA256 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA512 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

memory/2072-21-0x000000007EF00000-0x000000007EF10000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 14:39

Reported

2024-06-13 14:41

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2532 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 2532 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 2532 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 2284 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 2284 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe
PID 2284 wrote to memory of 624 N/A C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a610d5afb2a5f7459f5051d4c193f300_JaffaCakes118.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1268,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 service.downloadadmin.com udp
US 8.8.8.8:53 service.downloadadmin.com udp

Files

C:\Users\Admin\AppData\Local\Temp\9kwrVCuEYovPvHwazav\lua51.dll

MD5 f0c59526f8186eadaf2171b8fd2967c1
SHA1 8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA256 6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512 dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

C:\Users\Admin\AppData\Local\Temp\9kwrVCuEYovPvHwazav\extramod.dll

MD5 c41cfcef3e866372a37d34ef8483c0f9
SHA1 7ba6edd190e0ee5f9ede3adc0698386d14975622
SHA256 47def8ff1f6b2a4cb249a0e79144445f627cfcb6516bdbd7b64335efb856b0f9
SHA512 dd1829021c0afcf914effa77a3d7210736d9db12cfb7ae639c675566f4fbca57dedda2b7789bc9cb77b97960f5531b1f432df9dde8053924344bdc1805ee8ab5

memory/624-7-0x0000000000660000-0x0000000000676000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9kwrVCuEYovPvHwazav\shared_library.dll

MD5 ac7bc4b973cc32527e8500b8e925f88b
SHA1 c3fba0600b705a6fb6e83ddcb75c64d0009d2e41
SHA256 486c267edff7061fac7959c1e42a623e185288401648d85e730b95c10dec2a4d
SHA512 6140a614f845c3f03a26a737e7d077e4ed480a56b0a447c9e672c0d41ffca0b7b9bbc51e57d1809fc686aedba694f299c97da881cbc1a71d8da3e46efa2d6636

memory/624-17-0x000000007FE40000-0x000000007FE50000-memory.dmp

memory/624-14-0x0000000000680000-0x00000000006B6000-memory.dmp

memory/624-18-0x000000007FE30000-0x000000007FE40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9kwrVCuEYovPvHwazav\loading_screen.dll

MD5 44dac7f87bdf94d553f8d2cf073d605d
SHA1 21bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA256 0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA512 92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

memory/624-24-0x000000007FE40000-0x000000007FE50000-memory.dmp