Malware Analysis Report

2024-09-23 04:27

Sample ID 240617-hkydvsshmn
Target b744a22fe1fe174504289f5856d8fd70_JaffaCakes118
SHA256 a5476084f4beed4d510c9dab4a1544dde1c05cc0a88cfd55b316ef097ba2b273
Tags
metasploit backdoor trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a5476084f4beed4d510c9dab4a1544dde1c05cc0a88cfd55b316ef097ba2b273

Threat Level: Known bad

The file b744a22fe1fe174504289f5856d8fd70_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor trojan upx

MetaSploit

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-17 06:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 06:48

Reported

2024-06-17 06:50

Platform

win7-20240508-en

Max time kernel

141s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe"

Signatures

MetaSploit

trojan backdoor metasploit

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2416 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2416 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2416 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2416 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2416 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2416 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 2416 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
PID 1452 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
PID 1452 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
PID 1452 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
PID 1452 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
PID 1452 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
PID 1452 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
PID 1452 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
PID 1452 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Windows\SysWOW64\reg.exe
PID 1452 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Windows\SysWOW64\reg.exe
PID 1452 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Windows\SysWOW64\reg.exe
PID 1452 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1966258 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe" "__IRCT:3" "__IRTSS:20834512" "__IRSID:S-1-5-21-2737914667-933161113-3798636211-1000"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe" C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" export HKLM\Software\Stardock C:\Users\Admin\AppData\Local\Temp\registry_export.txt /reg:32 /y

Network

Country Destination Domain Proto
N/A 10.0.0.4:5567 tcp
US 8.8.8.8:53 install.api.stardock.net udp

Files

memory/2416-0-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/2416-3-0x0000000000400000-0x00000000017E3000-memory.dmp

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 ec503f49497b2fb6a8ce7dff9e40e3d9
SHA1 33ac3c49b68f7e81641253e94bbbacfb5886e7d2
SHA256 6d9462ac95d740f345db691291d18029533ced4d03ed2161387348a79167e36b
SHA512 1579d523a209ef0faa73625e9569b2c2769a6c16789602d3f37943bda65c1d48d6a9cf24cb9e6a3daff06ccf982f1c810abd60327fe0b83a16108b82f6bf5671

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 05ceb6d2e88a896d6ada0ab3f0dc40aa
SHA1 2b62cc437f5b3268acb3f569b43fd6c0a08e4e47
SHA256 b574d89422afcaae5446d8fd88d3b7cb48d608cf5411db761916b35c9999b41a
SHA512 fd9a03167c70ddd156d6942e503f7d9528e4748e9613cfba69181eb8b50fcaea9f6d3b9e1398da21d4e4c8bf47c99fe2becc88b98107a4fdcb80697510c1860f

memory/2416-19-0x00000000045C0000-0x00000000049A7000-memory.dmp

memory/2416-21-0x00000000045C0000-0x00000000049A7000-memory.dmp

memory/1452-27-0x0000000001120000-0x0000000001507000-memory.dmp

memory/2416-25-0x00000000045C0000-0x00000000049A7000-memory.dmp

memory/2416-35-0x00000000045C0000-0x00000000049A7000-memory.dmp

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Unicode.lmd

MD5 513c279740c287dec3508ae26d7916c0
SHA1 cafe05c4d5528d6fb51d94a33307d1e2cc5a9bf6
SHA256 a285299f207a0093158c05d46996b880032a9b11fb456ce78bba18988be9b14a
SHA512 8bf18cb54c3031863f0a0df5f064e78a8750c123878998ee45c10f50937eb875f7d1c75b867a25d60a858a976516d8ffabf5cc6d988a473cacd2d19909427dfe

memory/1452-40-0x0000000010000000-0x00000000100EC000-memory.dmp

\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe

MD5 55bbf335f75f2a2fe0a5daf603964d41
SHA1 f1b9686e8a9f10682722fc5e08c02c016b597804
SHA256 723adae0e69127a6bfbc65c5ef552a351264205ea5e2bc3b80e505feaa5d0e43
SHA512 af49055234cb4a0ddbc68212db094c7a7a1058ccf6a1a5830238fe3ff96fa35390d242322436839d6d7e419bd9e4ad8962e213222470625cffb46423dec44db6

memory/1452-55-0x0000000001010000-0x0000000001020000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp

MD5 97d86518f98394a87352f7f4ef3eec08
SHA1 93231558534e494cfc0f91cfa713209565fc6f46
SHA256 2727d87dbcb92d4e4e255ac7a6001043d9894faee3e6adf9c7196dd5ff1e4bae
SHA512 2bda915e142251ed409e17ce562f6c0aea6dd58c0a73d44d0459d73a681c85f3b11733cc3f1276f31dd17f437e99fcfe2c4840d5187553618d897d03c59ae2af

memory/1452-59-0x0000000001120000-0x0000000001507000-memory.dmp

memory/1452-60-0x0000000010000000-0x00000000100EC000-memory.dmp

memory/2416-61-0x00000000045C0000-0x00000000049A7000-memory.dmp

memory/1452-69-0x0000000010000000-0x00000000100EC000-memory.dmp

memory/1452-68-0x0000000001120000-0x0000000001507000-memory.dmp

memory/1452-70-0x0000000001010000-0x0000000001020000-memory.dmp

memory/1452-80-0x0000000010000000-0x00000000100EC000-memory.dmp

memory/2416-87-0x00000000001D0000-0x00000000001D1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 06:48

Reported

2024-06-17 06:50

Platform

win10v2004-20240508-en

Max time kernel

142s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1966258 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\b744a22fe1fe174504289f5856d8fd70_JaffaCakes118.exe" "__IRCT:3" "__IRTSS:20834512" "__IRSID:S-1-5-21-4124900551-4068476067-3491212533-1000"

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe

"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe" C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" export HKLM\Software\Stardock C:\Users\Admin\AppData\Local\Temp\registry_export.txt /reg:32 /y

Network

Country Destination Domain Proto
N/A 10.0.0.4:5567 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 install.api.stardock.net udp

Files

memory/3360-0-0x0000000001840000-0x0000000001841000-memory.dmp

memory/3360-3-0x0000000001840000-0x0000000001841000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

MD5 ec503f49497b2fb6a8ce7dff9e40e3d9
SHA1 33ac3c49b68f7e81641253e94bbbacfb5886e7d2
SHA256 6d9462ac95d740f345db691291d18029533ced4d03ed2161387348a79167e36b
SHA512 1579d523a209ef0faa73625e9569b2c2769a6c16789602d3f37943bda65c1d48d6a9cf24cb9e6a3daff06ccf982f1c810abd60327fe0b83a16108b82f6bf5671

memory/408-13-0x0000000000730000-0x0000000000B17000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

MD5 05ceb6d2e88a896d6ada0ab3f0dc40aa
SHA1 2b62cc437f5b3268acb3f569b43fd6c0a08e4e47
SHA256 b574d89422afcaae5446d8fd88d3b7cb48d608cf5411db761916b35c9999b41a
SHA512 fd9a03167c70ddd156d6942e503f7d9528e4748e9613cfba69181eb8b50fcaea9f6d3b9e1398da21d4e4c8bf47c99fe2becc88b98107a4fdcb80697510c1860f

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Unicode.lmd

MD5 513c279740c287dec3508ae26d7916c0
SHA1 cafe05c4d5528d6fb51d94a33307d1e2cc5a9bf6
SHA256 a285299f207a0093158c05d46996b880032a9b11fb456ce78bba18988be9b14a
SHA512 8bf18cb54c3031863f0a0df5f064e78a8750c123878998ee45c10f50937eb875f7d1c75b867a25d60a858a976516d8ffabf5cc6d988a473cacd2d19909427dfe

memory/408-33-0x0000000005E00000-0x0000000005E03000-memory.dmp

memory/408-32-0x0000000010000000-0x00000000100EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe

MD5 55bbf335f75f2a2fe0a5daf603964d41
SHA1 f1b9686e8a9f10682722fc5e08c02c016b597804
SHA256 723adae0e69127a6bfbc65c5ef552a351264205ea5e2bc3b80e505feaa5d0e43
SHA512 af49055234cb4a0ddbc68212db094c7a7a1058ccf6a1a5830238fe3ff96fa35390d242322436839d6d7e419bd9e4ad8962e213222470625cffb46423dec44db6

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp

MD5 9f64a97bf2bc6554556638a3f2343817
SHA1 c4982c0e1f4addb703557efd90ff3b908211e954
SHA256 daf7fdc5a6d0f2adffde58202a8566fe8ed2832aec03e378a1f69735ec9e5806
SHA512 d4943b9da6d994ed60a6572387c3c4943cae6792cc626a9bcae460547dc0eec21c2c21f71e13cb1a5f568188345ec88d9550e7d4c79020338562d0e33bcfbcf6

memory/408-48-0x0000000010000000-0x00000000100EC000-memory.dmp

memory/408-47-0x0000000000730000-0x0000000000B17000-memory.dmp

memory/408-56-0x0000000010000000-0x00000000100EC000-memory.dmp

memory/408-55-0x0000000000730000-0x0000000000B17000-memory.dmp

memory/408-57-0x0000000005E00000-0x0000000005E03000-memory.dmp

memory/408-59-0x0000000010000000-0x00000000100EC000-memory.dmp