Malware Analysis Report

2024-09-11 04:42

Sample ID 240623-jra3ksvdje
Target 059bc37591a2cd75283144ba1a690143_JaffaCakes118
SHA256 1c1718326a6808689521445b3ac18d2ff35ee6e1cca1a14d26bacfb65c9611bc
Tags
upx defense_evasion discovery exploit
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

1c1718326a6808689521445b3ac18d2ff35ee6e1cca1a14d26bacfb65c9611bc

Threat Level: Likely malicious

The file 059bc37591a2cd75283144ba1a690143_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

upx defense_evasion discovery exploit

Possible privilege escalation attempt

UPX packed file

Modifies file permissions

Checks computer location settings

Loads dropped DLL

Deletes itself

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
File and Directory Permissions Modification
T1222
Windows File and Directory Permissions Modification
T1222.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-23 07:53

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 07:53

Reported

2024-06-23 07:56

Platform

win7-20240611-en

Max time kernel

118s

Max time network

123s

Command Line

C:\Windows\system32\svchost.exe -k DcomLaunch

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\apa.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File created C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\regsvr32.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2084 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2084 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2084 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2084 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2084 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2084 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2084 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1312 wrote to memory of 2144 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 1312 wrote to memory of 2144 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 1312 wrote to memory of 2144 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 1312 wrote to memory of 2144 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 1312 wrote to memory of 2720 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 1312 wrote to memory of 2720 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 1312 wrote to memory of 2720 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 1312 wrote to memory of 2720 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 1312 wrote to memory of 588 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\system32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\~~f767475.tmp ,C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe

C:\Windows\SysWOW64\takeown.exe

takeown /f "C:\Windows\system32\rpcss.dll"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Windows\system32\rpcss.dll" /grant administrators:F

Network

N/A

Files

memory/2084-0-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2084-3-0x0000000000400000-0x0000000000421000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\~~f767475.tmp

MD5 ababb97700d28e978284cab9b3927505
SHA1 c28ba3d2e3f2f403a7cd8227f36bb8da0adeaca2
SHA256 8c0fe3d996f61fbc853b4872794c748bb66722320fc4cf9b8473feb8621074ea
SHA512 45b426ed7347c46daceaab52fdd1ad66807cb8b28bac93f12d14ce1c5805570855f79bb3b88006b8de70ff33b1aea62d12e4467273738f087ee4e2cbd240f031

memory/588-15-0x00000000004A0000-0x00000000004A1000-memory.dmp

C:\Windows\SysWOW64\apa.dll

MD5 1ebb39158c440c989615abb3965e87de
SHA1 11e8a4189e39ee8e880a57afff6a61aa6caab5ec
SHA256 91556452453c20680cb5af29a2ef0de379fd02206ad34ab93c78e8a1942c3975
SHA512 d958bd720bf80e24f2267f86dfb8a829311ac3288c305763d59f73b6f75049c7a679d2c77ed62eee344efc67b7fed519d7abd8ca0cf25574e88a9df6f94f1522

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-23 07:53

Reported

2024-06-23 07:56

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

151s

Command Line

C:\Windows\system32\svchost.exe -k DcomLaunch -p

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\apa.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File created C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\regsvr32.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1448 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1448 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1448 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4312 wrote to memory of 4584 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 4312 wrote to memory of 4584 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 4312 wrote to memory of 4584 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 4312 wrote to memory of 5100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 4312 wrote to memory of 5100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 4312 wrote to memory of 5100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 4312 wrote to memory of 792 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\system32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\~~e57f6a4.tmp ,C:\Users\Admin\AppData\Local\Temp\059bc37591a2cd75283144ba1a690143_JaffaCakes118.exe

C:\Windows\SysWOW64\takeown.exe

takeown /f "C:\Windows\system32\rpcss.dll"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Windows\system32\rpcss.dll" /grant administrators:F

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 142.250.178.10:443 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp

Files

memory/1448-0-0x0000000000400000-0x0000000000421000-memory.dmp

memory/1448-2-0x0000000000400000-0x0000000000421000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\~~e57f6a4.tmp

MD5 ababb97700d28e978284cab9b3927505
SHA1 c28ba3d2e3f2f403a7cd8227f36bb8da0adeaca2
SHA256 8c0fe3d996f61fbc853b4872794c748bb66722320fc4cf9b8473feb8621074ea
SHA512 45b426ed7347c46daceaab52fdd1ad66807cb8b28bac93f12d14ce1c5805570855f79bb3b88006b8de70ff33b1aea62d12e4467273738f087ee4e2cbd240f031

C:\Windows\SysWOW64\apa.dll

MD5 1ebb39158c440c989615abb3965e87de
SHA1 11e8a4189e39ee8e880a57afff6a61aa6caab5ec
SHA256 91556452453c20680cb5af29a2ef0de379fd02206ad34ab93c78e8a1942c3975
SHA512 d958bd720bf80e24f2267f86dfb8a829311ac3288c305763d59f73b6f75049c7a679d2c77ed62eee344efc67b7fed519d7abd8ca0cf25574e88a9df6f94f1522