Malware Analysis Report

2025-03-15 00:55

Sample ID 240626-thh2yavbpl
Target 1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118
SHA256 d7cbcaaacd806328450efa322ac27972e744e29edfb840d2067cf04c28fe3f78
Tags
defense_evasion
score
5/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
5/10

SHA256

d7cbcaaacd806328450efa322ac27972e744e29edfb840d2067cf04c28fe3f78

Threat Level: Likely benign

The file 1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118 was found to be: Likely benign.

Malicious Activity Summary

defense_evasion

Hide Artifacts: Hidden Files and Directories

Unsigned PE

Suspicious use of WriteProcessMemory

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-26 16:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 16:03

Reported

2024-06-26 16:05

Platform

win7-20240221-en

Max time kernel

118s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe"

Signatures

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1652 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1932 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1932 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1932 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1652 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ztmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ztmp"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ztmp

C:\Windows\SysWOW64\attrib.exe

attrib +h C:\Users\Admin\AppData\Local\Temp\ztmp

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ztmp\tmp8628.bat "C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 16:03

Reported

2024-06-26 16:05

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe"

Signatures

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4460 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 3904 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3904 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3904 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3904 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4460 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4460 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ztmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ztmp"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ztmp

C:\Windows\SysWOW64\attrib.exe

attrib +h C:\Users\Admin\AppData\Local\Temp\ztmp

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ztmp\tmp4928.bat "C:\Users\Admin\AppData\Local\Temp\1292dd0fed7b5e51655400e7a6f2d710_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c

Network

Files

N/A