Malware Analysis Report

2024-09-11 04:12

Sample ID 240625-pflb3aygqh
Target 0e08cd297f96d093d2a76f874664775b_JaffaCakes118
SHA256 8482ec09595a70a84a13c0a07f5e7d68b1b790951d12c0c46ddf98c03d40005e
Tags
upx defense_evasion discovery exploit
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

8482ec09595a70a84a13c0a07f5e7d68b1b790951d12c0c46ddf98c03d40005e

Threat Level: Likely malicious

The file 0e08cd297f96d093d2a76f874664775b_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

upx defense_evasion discovery exploit

Possible privilege escalation attempt

UPX packed file

Deletes itself

Modifies file permissions

Checks computer location settings

Loads dropped DLL

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

Drops file in System32 directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
File and Directory Permissions Modification
T1222
Windows File and Directory Permissions Modification
T1222.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-25 12:16

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 12:16

Reported

2024-06-25 12:18

Platform

win7-20240508-en

Max time kernel

121s

Max time network

122s

Command Line

C:\Windows\system32\svchost.exe -k DcomLaunch

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification C:\Windows\SysWOW64\apa.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File created C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\regsvr32.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2428 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2428 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2428 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2428 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2428 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2428 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2428 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2192 wrote to memory of 1632 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 2192 wrote to memory of 1632 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 2192 wrote to memory of 1632 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 2192 wrote to memory of 1632 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 2192 wrote to memory of 2700 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 2192 wrote to memory of 2700 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 2192 wrote to memory of 2700 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 2192 wrote to memory of 2700 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 2192 wrote to memory of 596 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\system32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\~~f761cb4.tmp ,C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe

C:\Windows\SysWOW64\takeown.exe

takeown /f "C:\Windows\system32\rpcss.dll"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Windows\system32\rpcss.dll" /grant administrators:F

Network

N/A

Files

memory/2428-0-0x0000000000400000-0x0000000000421000-memory.dmp

memory/2428-2-0x0000000000400000-0x0000000000421000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\~~f761cb4.tmp

MD5 dcf6a68f34bd65462c8f116908838e43
SHA1 441503cc74b5d8b12e7291c05ebc9aadd7072225
SHA256 36545f22411ccd3a63914092b8b83f60782d7ef157b5fe31da7a7118d8bdb186
SHA512 1d01f8f8d414dab670bbe2bd18dba868876e9883f9993a0a57b60a515bba7f0b9478697de49c6747942e94626519b3390b447cccb666d9da0cc2ceee5862052e

memory/596-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 12:16

Reported

2024-06-25 12:18

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

C:\Windows\system32\svchost.exe -k DcomLaunch -p

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\apa.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File created C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A
File opened for modification C:\Windows\SysWOW64\rpcss.dll C:\Windows\SysWOW64\regsvr32.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\regsvr32.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4384 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4384 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4384 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4000 wrote to memory of 4520 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 4000 wrote to memory of 4520 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 4000 wrote to memory of 4520 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\takeown.exe
PID 4000 wrote to memory of 4416 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 4000 wrote to memory of 4416 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 4000 wrote to memory of 4416 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\icacls.exe
PID 4000 wrote to memory of 804 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\svchost.exe

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\system32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\~~e57446b.tmp ,C:\Users\Admin\AppData\Local\Temp\0e08cd297f96d093d2a76f874664775b_JaffaCakes118.exe

C:\Windows\SysWOW64\takeown.exe

takeown /f "C:\Windows\system32\rpcss.dll"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Windows\system32\rpcss.dll" /grant administrators:F

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/4384-0-0x0000000000400000-0x0000000000421000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\~~e57446b.tmp

MD5 dcf6a68f34bd65462c8f116908838e43
SHA1 441503cc74b5d8b12e7291c05ebc9aadd7072225
SHA256 36545f22411ccd3a63914092b8b83f60782d7ef157b5fe31da7a7118d8bdb186
SHA512 1d01f8f8d414dab670bbe2bd18dba868876e9883f9993a0a57b60a515bba7f0b9478697de49c6747942e94626519b3390b447cccb666d9da0cc2ceee5862052e

C:\Windows\SysWOW64\apa.dll

MD5 fabdc8f73f0adc5a4172ebd0fa21007e
SHA1 901127f021cf5227ba3d56ea0248245dd6b392ed
SHA256 a625ed2d7cfe44cf4ba6840e335dfefaec71eb837ec9e83af65fe6513c18d830
SHA512 a35f08bb54ffa858dc9907fc26bda50f0486c784f39e0fe0905259645c205985ad7d10a12b41e5e4e0bfeb1253f69f232baeabc7b9647d309e4738f9e3f028a4