Malware Analysis Report

2024-10-16 06:31

Sample ID 240613-sdc5fstdnf
Target a62680b0fd0fc00c99b8da8b2d231024_JaffaCakes118
SHA256 6935b6068f5703be37fc522822b5f7012396577ea77fc3be7a30af98308db2e2
Tags
execution
score
3/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
3/10

SHA256

6935b6068f5703be37fc522822b5f7012396577ea77fc3be7a30af98308db2e2

Threat Level: Likely benign

The file a62680b0fd0fc00c99b8da8b2d231024_JaffaCakes118 was found to be: Likely benign.

Malicious Activity Summary

execution

Unsigned PE

Program crash

Command and Scripting Interpreter: JavaScript

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 15:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 15:00

Reported

2024-06-13 15:02

Platform

win7-20240220-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\demos\after\hello\out\production\hello\go-bins\helloworld.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\demos\after\hello\out\production\hello\go-bins\helloworld.exe

"C:\Users\Admin\AppData\Local\Temp\demos\after\hello\out\production\hello\go-bins\helloworld.exe"

Network

N/A

Files

memory/3036-0-0x0000000010910000-0x0000000010A10000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-13 15:00

Reported

2024-06-13 15:02

Platform

win7-20231129-en

Max time kernel

121s

Max time network

122s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\demos\after\hello\src\helloworld.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\demos\after\hello\src\helloworld.js

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-13 15:00

Reported

2024-06-13 15:02

Platform

win7-20240508-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\demos\before\hello\out\production\hello\go-bins\helloworld.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\demos\before\hello\out\production\hello\go-bins\helloworld.exe

"C:\Users\Admin\AppData\Local\Temp\demos\before\hello\out\production\hello\go-bins\helloworld.exe"

Network

N/A

Files

memory/1560-0-0x0000000010B50000-0x0000000010C50000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-13 15:00

Reported

2024-06-13 15:02

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\demos\before\hello\src\helloworld.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\demos\before\hello\src\helloworld.js

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 33.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 15:00

Reported

2024-06-13 15:02

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\demos\after\hello\out\production\hello\go-bins\helloworld.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\demos\after\hello\out\production\hello\go-bins\helloworld.exe

"C:\Users\Admin\AppData\Local\Temp\demos\after\hello\out\production\hello\go-bins\helloworld.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 320 -ip 320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 320 -ip 320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 424

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
BE 88.221.83.209:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 33.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 209.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-13 15:00

Reported

2024-06-13 15:02

Platform

win10v2004-20240508-en

Max time kernel

79s

Max time network

99s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\demos\after\hello\src\helloworld.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\demos\after\hello\src\helloworld.js

Network

Country Destination Domain Proto
US 52.111.227.14:443 tcp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-13 15:00

Reported

2024-06-13 15:02

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

52s

Command Line

"C:\Users\Admin\AppData\Local\Temp\demos\before\hello\out\production\hello\go-bins\helloworld.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\demos\before\hello\out\production\hello\go-bins\helloworld.exe

"C:\Users\Admin\AppData\Local\Temp\demos\before\hello\out\production\hello\go-bins\helloworld.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1624 -ip 1624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1624 -ip 1624

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 460

Network

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-13 15:00

Reported

2024-06-13 15:02

Platform

win7-20240611-en

Max time kernel

117s

Max time network

122s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\demos\before\hello\src\helloworld.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\demos\before\hello\src\helloworld.js

Network

N/A

Files

N/A